CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
252033 CVEs matched. Showing 301–350 (page 7 of 5041).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-121778 |
WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121779 |
WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-39733 |
WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability | MEDIUM | 5.3 | — | — | Patchstack | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-104738 |
Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters | HIGH | 8.1 | 8.1 | — | Wordfence | 2026-11-07 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-123957 |
TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow | CRITICAL | 9.4 | — | — | VulDB | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123881 |
OpenBMB Internet of Agents Message app.py fetch_chat_record access control | MEDIUM | 6.9 | — | — | VulDB | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118800 |
aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120537 |
TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary … | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-115811 |
Strong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameter | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 2 | ⚠ Threat | raw · ⬇ |
CVE-2026-118801 |
aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode | MEDIUM | 4.3 | 4.3 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121792 |
GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter | MEDIUM | 6.5 | — | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120530 |
WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography | MEDIUM | 5.7 | 5.7 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120479 |
WP Data Access <= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front… | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122265 |
Vanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parameter | MEDIUM | 5.9 | — | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122037 |
AgenWebsite Shipping <= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup Wizard | HIGH | 7.2 | — | — | Wordfence | 2026-11-07 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-87112 |
QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' … | HIGH | 8.8 | — | — | Wordfence | 2026-11-07 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-118204 |
WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Ren… | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121536 |
WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameter | MEDIUM | 5.3 | — | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-93370 |
Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on ord… | MEDIUM | 5.3 | — | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-116621 |
Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118048 |
WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-120515 |
SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_trac… | MEDIUM | 6.4 | 6.4 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-116558 |
Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget | HIGH | 7.2 | 7.2 | — | Wordfence | 2026-11-07 | 1 | ⚠ Threat | raw · ⬇ |
CVE-2026-103917 |
Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter | MEDIUM | 6.5 | 6.5 | — | Wordfence | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-83495 |
Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration | — | — | — | — | redhat | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-122001 |
Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121858 |
Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121857 |
Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121848 |
Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121796 |
Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121492 |
Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_up… | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121491 |
Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121380 |
Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API | — | — | 5.3 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-121379 |
Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion | — | — | 9.6 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-119073 |
Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module Pagination | — | — | 6.8 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118534 |
Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR | — | — | 4.3 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118533 |
Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt | — | — | 4.3 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118532 |
Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field | — | — | 6.5 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118530 |
Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action | — | — | 5.0 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118529 |
Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout | — | — | 3.1 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-118528 |
Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR | — | — | 4.3 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-117588 |
WP Google Review Slider < 18.11 - Google API Settings Update via CSRF | — | — | 4.3 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-117525 |
FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup | — | — | 7.5 | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2025-15708 |
Live Composer < 2.1.23 - Admin+ Stored XSS via Partner Slug | — | — | — | — | WPScan | 2026-11-07 | — | — | raw · ⬇ |
CVE-2026-97191 |
Advanced Custom Fields < 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-97190 |
Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-97189 |
Advanced Custom Fields < 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields | — | — | — | — | WPScan | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-18535 |
IBM API Connect Denial of Service | CRITICAL | 9.6 | — | — | ibm | 2026-11-07 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-19124 |
Multiple Vulnerabilities in IBM API Connect | MEDIUM | 6.8 | — | — | ibm | 2026-11-07 | 10 | — | raw · ⬇ |
CVE-2026-17393 |
Multiple Vulnerabilities in IBM API Connect | MEDIUM | 5.1 | — | — | ibm | 2026-11-07 | 10 | — | raw · ⬇ |