CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
229687 CVEs matched. Showing 1751–1800 (page 36 of 4594).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-93507 |
WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure | — | — | 3.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-91077 |
Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_lis… | — | — | 2.7 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-91073 |
Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-91025 |
Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-91024 |
Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid) | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-90985 |
WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_… | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-90951 |
Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment | — | — | 3.7 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-89331 |
FluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints | — | — | — | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-88997 |
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-88929 |
Sale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product Disclosure | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-87981 |
Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX… | — | — | — | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-87979 |
Paymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-87074 |
Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link | — | — | 3.7 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-87069 |
Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe | — | — | 3.1 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86842 |
Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86783 |
PostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST API | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86608 |
WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion | — | — | 8.2 | — | WPScan | 2026-09-23 | 20 | ⚠ Threat | raw · ⬇ |
CVE-2026-86603 |
WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86602 |
WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-85006 |
Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84743 |
The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via b… | — | — | 3.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84742 |
The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API | — | — | 2.7 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84741 |
The Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST API | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84168 |
Easy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL Disclosure | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84150 |
Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint | — | — | 5.4 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84098 |
Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing | — | — | 6.5 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84046 |
Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL | — | — | 5.0 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84027 |
Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-84026 |
Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-83555 |
Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verificatio… | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-82843 |
WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution | — | — | 9.0 | — | WPScan | 2026-09-23 | 20 | ⚠ Threat | raw · ⬇ |
CVE-2026-81339 |
MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-81338 |
MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions | — | — | 4.6 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-80342 |
Payment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID | — | — | 6.5 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-77766 |
Directorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-77765 |
Better Payment < 2.3.4 - Unauthenticated Payment Amount Manipulation | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-75799 |
YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache | — | — | 9.0 | — | WPScan | 2026-09-23 | 20 | ⚠ Threat | raw · ⬇ |
CVE-2026-18365 |
Zportals < 6.4.2 - Subscriber+ User Email Disclosure | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-18364 |
Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update | — | — | 4.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-16264 |
Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR | — | — | 6.5 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-14321 |
Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing | — | — | 8.2 | — | WPScan | 2026-09-23 | 20 | ⚠ Threat | raw · ⬇ |
CVE-2025-15696 |
Real3D Flipbook Lite < 5.4 - Author+ Stored XSS | — | — | 6.8 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-86785 |
Social Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update | — | — | 5.3 | — | WPScan | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-19438 |
Mint Workbench I Path traversal Vulnerability | HIGH | 8.2 | 7.5 | — | ABB | 2026-09-23 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-96258 |
onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting | MEDIUM | 5.3 | 4.3 | — | VulDB | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-96257 |
Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflow | CRITICAL | 10.0 | 10.0 | — | VulDB | 2026-09-23 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-95958 |
JusticeRage Manalyze PE Parser pe.cpp _parse_relocations integer underflow | MEDIUM | 4.8 | 3.3 | — | VulDB | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-95957 |
SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scri… | MEDIUM | 5.3 | 4.3 | — | VulDB | 2026-09-23 | 10 | — | raw · ⬇ |
CVE-2026-91777 |
jackson-databind: quadratic forward-reference completion in Collection and Map deserializers | HIGH | 7.5 | 7.5 | — | HeroDevs | 2026-09-23 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-91776 |
jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID | HIGH | 7.5 | 7.5 | — | HeroDevs | 2026-09-23 | 10 | ⚠ Threat | raw · ⬇ |