Browse All CVEs
33,499 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-42664 |
high | 8.2 | 0.0025 | 2026-10-29 | Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive | |
CVE-2026-42665 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. | |
CVE-2026-42666 |
high | 7.5 | 0.0028 | 2026-10-29 | Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions. | |
CVE-2026-42668 |
high | 7.5 | 0.0043 | 2026-10-29 | Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1. | |
CVE-2026-42688 |
medium | 6.5 | 0.0024 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions. | |
CVE-2026-42743 |
medium | 6.5 | 0.0014 | 2026-10-29 | Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions. | |
CVE-2026-42752 |
medium | 6.5 | 0.0022 | 2026-10-29 | Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions. | |
CVE-2026-42775 |
high | 7.1 | 0.0018 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions. | |
CVE-2026-45437 |
high | 7.1 | 0.0018 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 | |
CVE-2026-45439 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. | |
CVE-2026-45441 |
high | 7.5 | 0.0026 | 2026-10-29 | Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions. | |
CVE-2026-47261 |
high | 7.5 | 0.0036 | 2026-10-29 | Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, w | |
CVE-2026-47825 |
high | 8.6 | 0.0018 | 2026-10-29 | Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrus | |
CVE-2026-48518 |
medium | 4.3 | 0.0020 | 2026-10-29 | MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster w | |
CVE-2026-48835 |
high | 7.5 | 0.0031 | 2026-10-29 | Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions. | |
CVE-2026-48836 |
critical | 10.0 | 0.0057 | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. | |
CVE-2026-48838 |
high | 7.1 | 0.0024 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions. | |
CVE-2026-48867 |
high | 7.1 | 0.0018 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions. | |
CVE-2026-48868 |
high | 7.5 | 0.0028 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 | |
CVE-2026-48870 |
medium | 6.5 | 0.0021 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions. | |
CVE-2026-48871 |
high | 7.1 | 0.0023 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions. | |
CVE-2026-48872 |
high | 7.5 | 0.0035 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions. | |
CVE-2026-48873 |
high | 7.5 | 0.0024 | 2026-10-29 | Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions. | |
CVE-2026-48874 |
high | 8.5 | 0.0033 | 2026-10-29 | Subscriber SQL Injection in GamiPress <= 7.8.7 versions. | |
CVE-2026-48876 |
high | 7.1 | 0.0018 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions. | |
CVE-2026-48878 |
medium | 6.5 | 0.0034 | 2026-10-29 | Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions. | |
CVE-2026-48880 |
medium | 6.5 | 0.0021 | 2026-10-29 | Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions. | |
CVE-2026-48881 |
critical | 9.1 | 0.0028 | 2026-10-29 | Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. | |
CVE-2026-48882 |
high | 8.5 | 0.0033 | 2026-10-29 | Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions. | |
CVE-2026-48883 |
high | 7.5 | 0.0024 | 2026-10-29 | Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 vers | |
CVE-2026-48885 |
high | 7.1 | 0.0018 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions. | |
CVE-2026-48886 |
critical | 9.3 | 0.0028 | 2026-10-29 | Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. | |
CVE-2026-48887 |
medium | 6.5 | 0.0024 | 2026-10-29 | Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions. | |
CVE-2026-48889 |
high | 8.8 | 0.0041 | 2026-10-29 | Subscriber Privilege Escalation in Amelia <= 2.3 versions. | |
CVE-2026-48965 |
medium | 6.5 | 0.0033 | 2026-10-29 | Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions. | |
CVE-2026-48966 |
high | 7.1 | 0.0018 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 vers | |
CVE-2026-48970 |
high | 8.1 | 0.0039 | 2026-10-29 | Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions. | |
CVE-2026-49043 |
medium | 4.7 | 0.0015 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions. | |
CVE-2026-49055 |
high | 7.1 | 0.0023 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact | |
CVE-2026-49056 |
high | 7.5 | 0.0037 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delive | |
CVE-2026-49061 |
high | 7.5 | 0.0036 | 2026-10-29 | Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 ve | |
CVE-2026-49063 |
high | 7.3 | 0.0021 | 2026-10-29 | Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions. | |
CVE-2026-49065 |
high | 8.2 | 0.0025 | 2026-10-29 | Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versio | |
CVE-2026-49066 |
high | 7.5 | 0.0029 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions. | |
CVE-2026-49067 |
critical | 9.3 | 0.0029 | 2026-10-29 | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. | |
CVE-2026-49068 |
high | 7.5 | 0.0039 | 2026-10-29 | Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions. | |
CVE-2026-49082 |
high | 7.4 | 0.0026 | 2026-10-29 | Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Suppo | |
CVE-2026-49085 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elemento | |
CVE-2026-49104 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form | |
CVE-2026-49105 |
critical | 9.8 | 0.0048 | 2026-10-29 | Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, |