CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
251594 CVEs matched. Showing 1–50 (page 1 of 5032).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-114713 |
CVE-2026-114713 | HIGH | 8.6 | — | — | mitre | 2026-11-08 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120531 |
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]'… | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-119522 |
WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-120836 |
WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-120984 |
Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import | CRITICAL | 9.1 | — | — | redhat | 2026-11-07 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120839 |
WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability | HIGH | 8.8 | — | — | Patchstack | 2026-11-07 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-120841 |
WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability | HIGH | 8.8 | — | — | Patchstack | 2026-11-07 | — | ⚠ Threat | raw · ⬇ |
CVE-2026-121579 |
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XS… | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-121575 |
WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-120579 |
Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripti… | MEDIUM | 6.4 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-109973 |
Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Param… | MEDIUM | 6.4 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-119156 |
Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotl… | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-119498 |
WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-120509 |
Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter | MEDIUM | 4.7 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-115548 |
Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-111317 |
JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-109214 |
User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-111370 |
WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / … | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-109991 |
FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensi… | HIGH | 7.5 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-104014 |
Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via A… | CRITICAL | 9.8 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-118050 |
Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message | MEDIUM | 6.4 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-118267 |
WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameter… | HIGH | 8.1 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-120685 |
Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode C… | MEDIUM | 5.4 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-109230 |
WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-119075 |
Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout | CRITICAL | 9.8 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-104768 |
AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Rol… | HIGH | 7.5 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-120683 |
Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_te… | MEDIUM | 5.4 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-104760 |
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored… | MEDIUM | 6.4 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-103914 |
Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Pa… | MEDIUM | 6.5 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-119183 |
JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-116751 |
Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys | HIGH | 7.5 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-118066 |
Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Senti… | CRITICAL | 9.1 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-118056 |
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Sub… | MEDIUM | 4.9 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-118047 |
Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] … | MEDIUM | 6.4 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-116537 |
Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-102564 |
Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via … | MEDIUM | 6.5 | — | — | Wordfence | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-121265 |
SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update | — | — | — | — | CPANSec | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-121571 |
WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-119496 |
WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-119513 |
WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-120857 |
WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-120837 |
WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-121724 |
WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-120364 |
WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-119523 |
WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-119525 |
WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-120365 |
WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-119478 |
WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-119508 |
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vul… | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-119492 |
WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | — | — | raw · ⬇ |