Browse All CVEs
10,480 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-118276 |
medium | 5.1 | 0.0024 | 2026-10-29 | A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affec | |
CVE-2026-115522 |
medium | 5.3 | 0.0038 | 2026-10-29 | Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Deve | |
CVE-2026-103331 |
medium | 5.3 | 0.0023 | 2026-10-29 | The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly | |
CVE-2026-103372 |
medium | 5.3 | 0.0026 | 2026-10-29 | The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to se | |
CVE-2026-103382 |
medium | 5.3 | 0.0023 | 2026-10-29 | The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank | |
CVE-2026-104694 |
medium | 6.8 | 0.0030 | 2026-10-29 | The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a | |
CVE-2026-105997 |
medium | 5.3 | 0.0030 | 2026-10-29 | The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its b | |
CVE-2026-106002 |
medium | 5.3 | 0.0023 | 2026-10-29 | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation o | |
CVE-2026-106003 |
medium | 5.3 | 0.0027 | 2026-10-29 | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, | |
CVE-2026-107097 |
medium | 5.3 | 0.0023 | 2026-10-29 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any auth | |
CVE-2026-107098 |
medium | 6.8 | 0.0032 | 2026-10-29 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and esc | |
CVE-2026-107100 |
medium | 5.3 | 0.0026 | 2026-10-29 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a re | |
CVE-2026-109236 |
medium | 4.8 | 0.0034 | 2026-10-29 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Auth | |
CVE-2026-110292 |
medium | 6.5 | 0.0022 | 2026-10-29 | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that | |
CVE-2026-110506 |
medium | 6.8 | 0.0032 | 2026-10-29 | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape | |
CVE-2026-110509 |
medium | 5.3 | 0.0025 | 2026-10-29 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the po | |
CVE-2026-110524 |
medium | 6.8 | 0.0032 | 2026-10-29 | The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanit | |
CVE-2026-110691 |
medium | 6.5 | 0.0026 | 2026-10-29 | The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or valida | |
CVE-2026-111027 |
medium | 6.8 | 0.0030 | 2026-10-29 | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escap | |
CVE-2026-111031 |
medium | 4.7 | 0.0024 | 2026-10-29 | The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied UR | |
CVE-2026-111960 |
medium | 4.3 | 0.0021 | 2026-10-29 | The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type a | |
CVE-2026-111967 |
medium | 6.8 | 0.0032 | 2026-10-29 | The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player | |
CVE-2026-113485 |
medium | 6.5 | 0.0013 | 2026-10-29 | The Media Library Assistant WordPress plugin before 3.42 does not consistently validate it | |
CVE-2026-113486 |
medium | 6.5 | 0.0013 | 2026-10-29 | The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on i | |
CVE-2026-113487 |
medium | 6.8 | 0.0032 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a p | |
CVE-2026-113488 |
medium | 6.8 | 0.0032 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge sh | |
CVE-2026-113813 |
medium | 6.5 | 0.0021 | 2026-10-29 | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any | |
CVE-2026-115224 |
medium | 4.1 | 0.0024 | 2026-10-29 | The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQ | |
CVE-2026-115225 |
medium | 5.8 | 0.0024 | 2026-10-29 | The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to | |
CVE-2026-115255 |
medium | 5.3 | 0.0023 | 2026-10-29 | The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks | |
CVE-2026-115281 |
medium | 6.8 | 0.0030 | 2026-10-29 | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a blo | |
CVE-2026-100175 |
medium | 5.4 | 0.0033 | 2026-10-29 | The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Bod | |
CVE-2026-103370 |
medium | 6.4 | 0.0026 | 2026-10-29 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerab | |
CVE-2026-103996 |
medium | 6.4 | 0.0024 | 2026-10-29 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordP | |
CVE-2026-104729 |
medium | 6.4 | 0.0016 | 2026-10-29 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripti | |
CVE-2026-104740 |
medium | 6.4 | 0.0024 | 2026-10-29 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordP | |
CVE-2026-104743 |
medium | 4.9 | 0.0084 | 2026-10-29 | The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up | |
CVE-2026-107710 |
medium | 6.4 | 0.0020 | 2026-10-29 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vuln | |
CVE-2026-108366 |
medium | 6.4 | 0.0021 | 2026-10-29 | The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solut | |
CVE-2026-109370 |
medium | 6.4 | 0.0022 | 2026-10-29 | The Document Embedder – let visitors read files without downloading plugin for WordPress i | |
CVE-2026-109385 |
medium | 6.4 | 0.0026 | 2026-10-29 | The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plug | |
CVE-2026-109590 |
medium | 6.4 | 0.0024 | 2026-10-29 | The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting | |
CVE-2026-109972 |
medium | 6.4 | 0.0027 | 2026-10-29 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Memb | |
CVE-2026-109975 |
medium | 6.4 | 0.0020 | 2026-10-29 | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns | |
CVE-2026-109978 |
medium | 6.4 | 0.0024 | 2026-10-29 | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns | |
CVE-2026-109979 |
medium | 4.3 | 0.0030 | 2026-10-29 | The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Informatio | |
CVE-2026-109980 |
medium | 4.3 | 0.0022 | 2026-10-29 | The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Informatio | |
CVE-2026-109988 |
medium | 4.4 | 0.0021 | 2026-10-29 | The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPre | |
CVE-2026-110020 |
medium | 6.5 | 0.0038 | 2026-10-29 | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization b | |
CVE-2026-110071 |
medium | 6.4 | 0.0020 | 2026-10-29 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' |