CVE Vulnerability Database
Search and browse 423,961 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-87974 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, acce... |
| CVE-2026-87968 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin b... |
| CVE-2026-87843 | MEDIUM | 6.5 | 0.2% | Oct 14, 2026 | The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment... |
| CVE-2026-86799 | HIGH | 8.8 | 0.2% | Oct 14, 2026 | The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outpu... |
| CVE-2026-86797 | MEDIUM | 6.8 | 0.2% | Oct 14, 2026 | The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of it... |
| CVE-2026-86787 | HIGH | 7.2 | 0.2% | Oct 14, 2026 | The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template bo... |
| CVE-2026-85345 | MEDIUM | 4.1 | 0.2% | Oct 14, 2026 | The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before... |
| CVE-2026-85000 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated reque... |
| CVE-2026-110467 | MEDIUM | 4.3 | 0.3% | Oct 14, 2026 | Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers... |
| CVE-2026-110466 | MEDIUM | 4.3 | 0.3% | Oct 14, 2026 | Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypa... |
| CVE-2026-110465 | MEDIUM | 4.3 | 0.3% | Oct 14, 2026 | Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers... |
| CVE-2026-108069 | MEDIUM | 5.3 | 0.1% | Oct 14, 2026 | The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restric... |
| CVE-2026-108066 | LOW | 2.7 | 0.2% | Oct 14, 2026 | The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two... |
| CVE-2026-108064 | MEDIUM | 6.5 | 0.1% | Oct 14, 2026 | The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers t... |
| CVE-2026-107594 | CRITICAL | 10 | 0.2% | Oct 14, 2026 | The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-cont... |
| CVE-2026-107508 | HIGH | 8.6 | 0.2% | Oct 14, 2026 | The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to ... |
| CVE-2026-107320 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowin... |
| CVE-2026-107319 | MEDIUM | 4.3 | 0.2% | Oct 14, 2026 | The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its... |
| CVE-2026-107178 | MEDIUM | 6.8 | 0.2% | Oct 14, 2026 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration v... |
| CVE-2026-107160 | MEDIUM | 5.3 | 0.1% | Oct 14, 2026 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization be... |
| CVE-2026-107158 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of ... |
| CVE-2026-107126 | HIGH | 8.8 | 0.2% | Oct 14, 2026 | The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value ... |
| CVE-2026-106646 | MEDIUM | 5.9 | 0.2% | Oct 14, 2026 | The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target lis... |
| CVE-2026-106469 | MEDIUM | 6.8 | 0.2% | Oct 14, 2026 | The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before i... |
| CVE-2026-106166 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks ... |