CVE Vulnerability Database
Search and browse 423,865 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-109512 | MEDIUM | 6.4 | 0.2% | Oct 16, 2026 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all vers... |
| CVE-2026-109400 | HIGH | 7.5 | 0.4% | Oct 16, 2026 | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all v... |
| CVE-2026-109221 | HIGH | 8.1 | 0.8% | Oct 16, 2026 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletio... |
| CVE-2026-109219 | CRITICAL | 9.8 | 0.7% | Oct 16, 2026 | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload func... |
| CVE-2026-109191 | MEDIUM | 4.3 | 0.3% | Oct 16, 2026 | The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sens... |
| CVE-2026-107746 | HIGH | 7.5 | 0.3% | Oct 16, 2026 | The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in al... |
| CVE-2026-107659 | HIGH | 7.5 | 0.3% | Oct 16, 2026 | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposu... |
| CVE-2026-104798 | CRITICAL | 9.8 | 0.9% | Oct 16, 2026 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up... |
| CVE-2026-103911 | MEDIUM | 6.5 | 0.3% | Oct 16, 2026 | The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitr... |
| CVE-2026-103895 | HIGH | 8.1 | 0.4% | Oct 16, 2026 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass... |
| CVE-2026-103525 | HIGH | 7.5 | 0.4% | Oct 16, 2026 | The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Dire... |
| CVE-2026-103481 | MEDIUM | 6.1 | 0.2% | Oct 16, 2026 | The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter ... |
| CVE-2026-101335 | MEDIUM | 6.5 | 0.3% | Oct 16, 2026 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary ... |
| CVE-2026-97339 | HIGH | 7.2 | 0.3% | Oct 16, 2026 | The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comm... |
| CVE-2026-93953 | HIGH | 8 | 0.3% | Oct 16, 2026 | The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographic... |
| CVE-2026-93535 | MEDIUM | 6.4 | 0.2% | Oct 16, 2026 | The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site... |
| CVE-2026-89280 | MEDIUM | 4.3 | 0.2% | Oct 16, 2026 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPr... |
| CVE-2026-77829 | MEDIUM | 6.4 | 0.2% | Oct 16, 2026 | The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shor... |
| CVE-2026-111451 | HIGH | 7.8 | 0.1% | Oct 16, 2026 | Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy r... |
| CVE-2026-111450 | MEDIUM | 5.9 | 0.1% | Oct 16, 2026 | Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts ... |
| CVE-2026-111449 | MEDIUM | 5.9 | 0.2% | Oct 16, 2026 | Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An ... |
| CVE-2026-111448 | LOW | 3.7 | 0.2% | Oct 16, 2026 | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. C... |
| CVE-2026-111447 | HIGH | 8.1 | 0.3% | Oct 16, 2026 | Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to ... |
| CVE-2026-111446 | HIGH | 8.6 | 0.3% | Oct 16, 2026 | Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicCo... |
| CVE-2026-111445 | HIGH | 8.1 | 0.3% | Oct 16, 2026 | Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() a... |