CVE Vulnerability Database
Search and browse 424,958 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-107323 | MEDIUM | 6.8 | 0.3% | Oct 10, 2026 | The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before ou... |
| CVE-2026-107321 | MEDIUM | 5.4 | 0.2% | Oct 10, 2026 | The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor en... |
| CVE-2026-107120 | MEDIUM | 5.3 | 0.2% | Oct 10, 2026 | The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registra... |
| CVE-2026-105995 | MEDIUM | 5.3 | 0.3% | Oct 10, 2026 | The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reserva... |
| CVE-2026-105990 | MEDIUM | 5.3 | 0.3% | Oct 10, 2026 | The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks ... |
| CVE-2026-105989 | MEDIUM | 5.3 | 0.2% | Oct 10, 2026 | The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or requ... |
| CVE-2026-105977 | LOW | 2.2 | 0.2% | Oct 10, 2026 | The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before del... |
| CVE-2026-105976 | MEDIUM | 4.7 | 0.2% | Oct 10, 2026 | The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJA... |
| CVE-2026-104899 | HIGH | 8.1 | 0.6% | Oct 10, 2026 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to ... |
| CVE-2026-104766 | HIGH | 8.8 | 0.3% | Oct 10, 2026 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to P... |
| CVE-2026-104763 | MEDIUM | 4.9 | 0.7% | Oct 10, 2026 | The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and i... |
| CVE-2026-104762 | MEDIUM | 6.4 | 0.2% | Oct 10, 2026 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site S... |
| CVE-2026-104754 | LOW | 3.5 | 0.2% | Oct 10, 2026 | The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting i... |
| CVE-2026-104753 | MEDIUM | 4.1 | 0.2% | Oct 10, 2026 | The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in ... |
| CVE-2026-104752 | HIGH | 7.2 | 0.5% | Oct 10, 2026 | The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its s... |
| CVE-2026-104742 | LOW | 3.1 | 0.3% | Oct 10, 2026 | The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass i... |
| CVE-2026-104741 | LOW | 3.1 | 0.3% | Oct 10, 2026 | The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass i... |
| CVE-2026-104725 | HIGH | 8.8 | 0.3% | Oct 10, 2026 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation i... |
| CVE-2026-104723 | HIGH | 8.8 | 0.4% | Oct 10, 2026 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injecti... |
| CVE-2026-104023 | MEDIUM | 4.9 | 0.4% | Oct 10, 2026 | The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all... |
| CVE-2026-103912 | MEDIUM | 4.7 | 0.2% | Oct 10, 2026 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Sc... |
| CVE-2026-103520 | MEDIUM | 6.4 | 0.2% | Oct 10, 2026 | The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-... |
| CVE-2026-103482 | MEDIUM | 5.4 | 0.3% | Oct 10, 2026 | The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptin_... |
| CVE-2026-9696 | MEDIUM | 6.4 | 0.2% | Oct 10, 2026 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in ... |
| CVE-2026-97670 | CRITICAL | 9.1 | 0.4% | Oct 10, 2026 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includi... |