Browse All CVEs
50,444 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-120848 |
medium | 6.5 | 0.0017 | 2026-11-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-121781 |
medium | 5.3 | 0.0019 | 2026-11-07 | Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking al | |
CVE-2026-120849 |
medium | 4.3 | 0.0015 | 2026-11-07 | Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketpla | |
CVE-2026-119489 |
medium | 6.5 | 0.0013 | 2026-11-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-105137 |
low | 1.3 | 0.0016 | 2026-11-07 | A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the f | |
CVE-2026-123957 |
high | 8.6 | 0.0047 | 2026-11-07 | A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function se | |
CVE-2026-104738 |
high | 8.1 | 0.0045 | 2026-11-07 | The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnera | |
CVE-2026-123881 |
medium | 6.9 | 0.0028 | 2026-11-07 | A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c0 | |
CVE-2026-62032 |
critical | 9.8 | 0.0040 | 2026-11-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote Fil | |
CVE-2026-93370 |
medium | 5.3 | 0.0027 | 2026-11-07 | The Paystack WooCommerce Payment Gateway plugin for WordPress is vulnerable to Sensitive I | |
CVE-2026-87112 |
high | 8.8 | 0.0080 | 2026-11-07 | The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Inject | |
CVE-2026-122265 |
medium | 5.9 | 0.0074 | 2026-11-07 | The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory | |
CVE-2026-122037 |
high | 7.2 | 0.0024 | 2026-11-07 | The AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi Otomatis Semua Kurir Indone | |
CVE-2026-121792 |
medium | 6.5 | 0.0028 | 2026-11-07 | The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now wit | |
CVE-2026-121536 |
medium | 5.3 | 0.0026 | 2026-11-07 | The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for W | |
CVE-2026-120537 |
high | 7.2 | 0.0025 | 2026-11-07 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress | |
CVE-2026-120530 |
medium | 5.7 | 0.0024 | 2026-11-07 | The WebToffee WP Backup and Migration plugin for WordPress is vulnerable to generic SQL In | |
CVE-2026-120515 |
medium | 6.4 | 0.0020 | 2026-11-07 | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cr | |
CVE-2026-120479 |
medium | 6.4 | 0.0020 | 2026-11-07 | The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for W | |
CVE-2026-118801 |
medium | 4.3 | 0.0022 | 2026-11-07 | The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Anim | |
CVE-2026-118800 |
medium | 6.4 | 0.0020 | 2026-11-07 | The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Anim | |
CVE-2026-118204 |
medium | 6.4 | 0.0019 | 2026-11-07 | The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for W | |
CVE-2026-118048 |
medium | 6.4 | 0.0019 | 2026-11-07 | The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | |
CVE-2026-116621 |
medium | 6.4 | 0.0020 | 2026-11-07 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restric | |
CVE-2026-116558 |
high | 7.2 | 0.0024 | 2026-11-07 | The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Si | |
CVE-2026-115811 |
high | 7.2 | 0.0029 | 2026-11-07 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting | |
CVE-2026-103917 |
medium | 6.5 | 0.0028 | 2026-11-07 | The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is v | |
CVE-2023-5156 |
high | 7.5 | 0.0163 | 2026-11-07 | A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the poten | |
CVE-2023-5090 |
medium | 5.5 | 0.0025 | 2026-11-07 | A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow | |
CVE-2023-34966 |
high | 7.5 | 0.6240 | 2026-11-07 | An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When | |
CVE-2026-83495 |
— | — | 0.0014 | 2026-11-07 | A flaw was found in the Trainer v2 TrainJob API. A user with permissions to create TrainJo | |
CVE-2026-97191 |
low | 2.7 | 0.0017 | 2026-11-07 | The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its fie | |
CVE-2026-97190 |
low | 2.7 | 0.0017 | 2026-11-07 | The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a us | |
CVE-2026-97189 |
low | 2.7 | 0.0019 | 2026-11-07 | The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-p | |
CVE-2026-122001 |
high | 8.8 | 0.0013 | 2026-11-07 | The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate | |
CVE-2026-121866 |
high | 8.8 | 0.0023 | 2026-11-07 | The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities | |
CVE-2026-121858 |
medium | 6.3 | 0.0018 | 2026-11-07 | The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly esca | |
CVE-2026-121857 |
medium | 4.2 | 0.0012 | 2026-11-07 | The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a | |
CVE-2026-121848 |
high | 8.8 | 0.0029 | 2026-11-07 | The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a lo | |
CVE-2026-121796 |
medium | 6.8 | 0.0029 | 2026-11-07 | The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to us | |
CVE-2026-121492 |
medium | 5.3 | 0.0022 | 2026-11-07 | The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some o | |
CVE-2026-121491 |
critical | 9.0 | 0.0040 | 2026-11-07 | The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header | |
CVE-2026-121380 |
medium | 5.3 | 0.0025 | 2026-11-07 | The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitat | |
CVE-2026-121379 |
critical | 9.6 | 0.0030 | 2026-11-07 | The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a | |
CVE-2026-119073 |
medium | 6.8 | 0.0029 | 2026-11-07 | The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting sup | |
CVE-2026-118534 |
medium | 4.3 | 0.0019 | 2026-11-07 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin | |
CVE-2026-118533 |
medium | 4.3 | 0.0020 | 2026-11-07 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin | |
CVE-2026-118532 |
medium | 6.5 | 0.0024 | 2026-11-07 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin | |
CVE-2026-118530 |
medium | 5.0 | 0.0021 | 2026-11-07 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin | |
CVE-2026-118529 |
low | 3.1 | 0.0016 | 2026-11-07 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin |