CVE Vulnerability Database
Search and browse 425,064 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-104313 | MEDIUM | 6.1 | 0.2% | Oct 3, 2026 | The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via... |
| CVE-2026-103519 | MEDIUM | 5.4 | 0.3% | Oct 3, 2026 | The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an... |
| CVE-2026-103421 | MEDIUM | 5.4 | 0.2% | Oct 3, 2026 | The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the... |
| CVE-2026-100157 | MEDIUM | 6.5 | 0.3% | Oct 3, 2026 | The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an... |
| CVE-2026-97344 | MEDIUM | 6.4 | 0.2% | Oct 3, 2026 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Av... |
| CVE-2026-97341 | HIGH | 7.2 | 0.3% | Oct 3, 2026 | The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via... |
| CVE-2026-97337 | HIGH | 7.5 | 0.4% | Oct 3, 2026 | The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information ... |
| CVE-2026-96962 | LOW | 3.7 | 0.2% | Oct 3, 2026 | The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unaut... |
| CVE-2026-96650 | HIGH | 7.2 | 0.3% | Oct 3, 2026 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Cust... |
| CVE-2026-96575 | HIGH | 7.2 | 0.2% | Oct 3, 2026 | The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Si... |
| CVE-2026-96564 | HIGH | 7.2 | 0.2% | Oct 3, 2026 | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author ... |
| CVE-2026-94239 | MEDIUM | 6.8 | 0.2% | Oct 3, 2026 | The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before ou... |
| CVE-2026-94238 | MEDIUM | 6.8 | 0.3% | Oct 3, 2026 | The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will rea... |
| CVE-2026-93430 | HIGH | 7.2 | 0.3% | Oct 3, 2026 | The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args... |
| CVE-2026-92923 | MEDIUM | 6.3 | 0.2% | Oct 3, 2026 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before usin... |
| CVE-2026-92437 | MEDIUM | 5.3 | 0.2% | Oct 3, 2026 | The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check... |
| CVE-2026-91108 | MEDIUM | 4.3 | 0.2% | Oct 3, 2026 | The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to ... |
| CVE-2026-91078 | HIGH | 8.2 | 0.2% | Oct 3, 2026 | The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS acco... |
| CVE-2026-89236 | HIGH | 8.6 | 0.3% | Oct 3, 2026 | The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the... |
| CVE-2026-88783 | HIGH | 8.8 | 0.3% | Oct 3, 2026 | The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the ... |
| CVE-2026-88782 | MEDIUM | 6.8 | 0.2% | Oct 3, 2026 | The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before... |
| CVE-2026-87091 | HIGH | 7.2 | 0.3% | Oct 3, 2026 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Par... |
| CVE-2026-86834 | LOW | 3.7 | 0.2% | Oct 3, 2026 | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root o... |
| CVE-2026-86832 | MEDIUM | 5.3 | 0.2% | Oct 3, 2026 | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthent... |
| CVE-2026-85568 | MEDIUM | 6.8 | 0.2% | Oct 3, 2026 | The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewr... |