CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
252033 CVEs matched. Showing 201–250 (page 5 of 5041).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-109214 |
User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-111370 |
WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / … | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-109991 |
FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensi… | HIGH | 7.5 | 7.5 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-104014 |
Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via A… | CRITICAL | 9.8 | 9.8 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-118050 |
Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118267 |
WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameter… | HIGH | 8.1 | 8.1 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-123418 |
Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-121976 |
Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter | MEDIUM | 6.4 | — | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122231 |
WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-120685 |
Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode C… | MEDIUM | 5.4 | 5.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-109230 |
WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-93766 |
Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-119075 |
Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout | CRITICAL | 9.8 | 9.8 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-104768 |
AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Rol… | HIGH | 7.5 | 7.5 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-120683 |
Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_te… | MEDIUM | 5.4 | 5.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-104760 |
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored… | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-103914 |
Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Pa… | MEDIUM | 6.5 | 6.5 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119183 |
JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-96565 |
WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout… | MEDIUM | 6.4 | — | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-116751 |
Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys | HIGH | 7.5 | 7.5 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-118066 |
Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Senti… | CRITICAL | 9.1 | 9.1 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-122059 |
WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute | MEDIUM | 6.4 | — | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118056 |
Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Sub… | MEDIUM | 4.9 | 4.9 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118047 |
Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] … | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-116537 |
Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-93755 |
Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-102564 |
Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via … | MEDIUM | 6.5 | 6.5 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121265 |
SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update | — | — | — | — | CPANSec | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121571 |
WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119496 |
WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123470 |
WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119513 |
WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123468 |
WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120857 |
WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123148 |
WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120837 |
WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121724 |
WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120364 |
WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119523 |
WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119525 |
WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120365 |
WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119478 |
WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119508 |
WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vul… | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119492 |
WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119501 |
WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123961 |
TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow | CRITICAL | 9.4 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-121783 |
WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119490 |
WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119486 |
WordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119500 |
WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |