CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
252033 CVEs matched. Showing 251–300 (page 6 of 5041).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-120840 |
WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120842 |
WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119520 |
WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119494 |
WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120850 |
WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119493 |
WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123960 |
TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow | CRITICAL | 9.4 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123959 |
TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow | CRITICAL | 9.4 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-119507 |
WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119473 |
WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119465 |
WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121762 |
WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability | HIGH | 8.8 | — | — | Patchstack | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-107616 |
Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attende… | HIGH | 7.5 | 7.5 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-120532 |
wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-95870 |
wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter | HIGH | 7.5 | — | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-119164 |
wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter | HIGH | 7.5 | 7.5 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-103900 |
WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter | HIGH | 8.1 | 8.1 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-118784 |
WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-104992 |
Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Infor… | MEDIUM | 6.5 | 6.5 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119155 |
wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter | HIGH | 7.5 | 7.5 | — | Wordfence | 2026-11-07 | 9 | ⚠ Threat | raw · ⬇ |
CVE-2026-120548 |
YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action… | MEDIUM | 5.3 | 5.3 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-110004 |
wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter | MEDIUM | 6.5 | 6.5 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120514 |
Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Pa… | MEDIUM | 5.4 | 5.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123464 |
WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119502 |
WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122668 |
WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120853 |
WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120852 |
WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123469 |
WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119491 |
WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-61990 |
WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119484 |
WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability | MEDIUM | 6.3 | 6.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120847 |
WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119511 |
WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability | MEDIUM | 5.3 | 5.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121766 |
WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerability | MEDIUM | 5.4 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123466 |
WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121768 |
WordPress Contact Form 7 – Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-52713 |
WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability | MEDIUM | 5.4 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119467 |
WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability | MEDIUM | 5.4 | 5.4 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-66669 |
WordPress Superb Addons: Blocks, Patterns & theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulne… | HIGH | 8.8 | — | — | Patchstack | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-119510 |
WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-123958 |
TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow | CRITICAL | 9.4 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-121781 |
WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119489 |
WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120849 |
WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability | MEDIUM | 4.3 | 4.3 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120848 |
WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 6.5 | 6.5 | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-124274 |
WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122675 |
WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability | MEDIUM | 5.4 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121761 |
WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability | MEDIUM | 4.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121767 |
WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |