CVE Vulnerability Database
Search and browse 424,017 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-92409 | MEDIUM | 6.8 | 0.2% | Oct 14, 2026 | The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute b... |
| CVE-2026-91076 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incom... |
| CVE-2026-90989 | MEDIUM | 4.3 | 0.2% | Oct 14, 2026 | The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capab... |
| CVE-2026-89310 | CRITICAL | 9.9 | 0.5% | Oct 14, 2026 | A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowin... |
| CVE-2026-89288 | HIGH | 8.6 | 0.2% | Oct 14, 2026 | The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on a... |
| CVE-2026-88927 | MEDIUM | 4.3 | 0.2% | Oct 14, 2026 | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may... |
| CVE-2026-87974 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, acce... |
| CVE-2026-87968 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin b... |
| CVE-2026-87843 | MEDIUM | 6.5 | 0.2% | Oct 14, 2026 | The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment... |
| CVE-2026-86799 | HIGH | 8.8 | 0.2% | Oct 14, 2026 | The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outpu... |
| CVE-2026-86797 | MEDIUM | 6.8 | 0.2% | Oct 14, 2026 | The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of it... |
| CVE-2026-86787 | HIGH | 7.2 | 0.2% | Oct 14, 2026 | The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template bo... |
| CVE-2026-85345 | MEDIUM | 4.1 | 0.2% | Oct 14, 2026 | The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before... |
| CVE-2026-85000 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated reque... |
| CVE-2026-110467 | MEDIUM | 4.3 | 0.3% | Oct 14, 2026 | Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers... |
| CVE-2026-110466 | MEDIUM | 4.3 | 0.3% | Oct 14, 2026 | Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypa... |
| CVE-2026-110465 | MEDIUM | 4.3 | 0.3% | Oct 14, 2026 | Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers... |
| CVE-2026-108069 | MEDIUM | 5.3 | 0.1% | Oct 14, 2026 | The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restric... |
| CVE-2026-108066 | LOW | 2.7 | 0.2% | Oct 14, 2026 | The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two... |
| CVE-2026-108064 | MEDIUM | 6.5 | 0.1% | Oct 14, 2026 | The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers t... |
| CVE-2026-107594 | CRITICAL | 10 | 0.2% | Oct 14, 2026 | The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-cont... |
| CVE-2026-107508 | HIGH | 8.6 | 0.2% | Oct 14, 2026 | The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to ... |
| CVE-2026-107320 | MEDIUM | 5.3 | 0.2% | Oct 14, 2026 | The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowin... |
| CVE-2026-107319 | MEDIUM | 4.3 | 0.2% | Oct 14, 2026 | The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its... |
| CVE-2026-107178 | MEDIUM | 6.8 | 0.2% | Oct 14, 2026 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration v... |