CVE Vulnerability Database
Search and browse 424,901 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-91829 | HIGH | 7.1 | 0.2% | Oct 11, 2026 | The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into... |
| CVE-2026-89305 | MEDIUM | 6.5 | 0.2% | Oct 11, 2026 | The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL qu... |
| CVE-2026-89304 | MEDIUM | 6.5 | 0.2% | Oct 11, 2026 | The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL qu... |
| CVE-2026-89302 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in... |
| CVE-2026-89299 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a ... |
| CVE-2026-89297 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in ... |
| CVE-2026-89287 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQ... |
| CVE-2026-89285 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them... |
| CVE-2026-89283 | HIGH | 8.6 | 0.2% | Oct 11, 2026 | The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bul... |
| CVE-2026-89234 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, a... |
| CVE-2026-89232 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query... |
| CVE-2026-89214 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a... |
| CVE-2026-89213 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL... |
| CVE-2026-89195 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it i... |
| CVE-2026-88930 | HIGH | 8.6 | 0.3% | Oct 11, 2026 | The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requ... |
| CVE-2026-88905 | HIGH | 8.8 | 0.3% | Oct 11, 2026 | The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settin... |
| CVE-2026-88903 | HIGH | 8.8 | 0.3% | Oct 11, 2026 | The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML ... |
| CVE-2026-88827 | HIGH | 8.8 | 0.3% | Oct 11, 2026 | The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication pa... |
| CVE-2026-88826 | HIGH | 8.8 | 0.2% | Oct 11, 2026 | The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores... |
| CVE-2026-88785 | MEDIUM | 4.7 | 0.1% | Oct 11, 2026 | The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext pa... |
| CVE-2026-87764 | HIGH | 8.8 | 0.3% | Oct 11, 2026 | The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the... |
| CVE-2026-87762 | HIGH | 8.8 | 0.4% | Oct 11, 2026 | The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-cha... |
| CVE-2026-87761 | HIGH | 8 | 0.3% | Oct 11, 2026 | The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before a... |
| CVE-2026-87760 | HIGH | 8.8 | 0.3% | Oct 11, 2026 | The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by... |
| CVE-2026-86798 | HIGH | 8.8 | 0.3% | Oct 11, 2026 | The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, an... |