Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 404,876All CVEsplus 19,157 rejected
- 2,093Last 24 hours4,683 in the last 7 days
- 18,906Last 30 days1,626 of them critical
- 1,779Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 252 | 1,068 | 2,601 | 20 | 0 | 3,941 | 12,117 |
| 2025 | 262 | 703 | 2,470 | 15 | 0 | 3,450 | 8,176 |
| 2024 | 200 | 565 | 2,745 | 14 | 0 | 3,524 | 4,726 |
| 2023 | 66 | 191 | 613 | 9 | 0 | 879 | 1,202 |
| 2022 | 14 | 62 | 92 | 1 | 0 | 169 | 323 |
| 2021 | 6 | 31 | 117 | 0 | 0 | 154 | 154 |
| Title | ||
|---|---|---|
| CVE-2026-111190 | ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME HeaderARforms | High8.1 |
| CVE-2026-12427 | ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' ParameterARforms | High7.2 |
| CVE-2026-12424 | ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer HeaderARforms | High7.2 |
| CVE-2026-15785 | Joinchat <= 6.3.1 - Reflected Cross-Site Scripting via '{HREF}' Dynamic Variablecreapuntome · Joinchat – Enhanced “click to chat” | Medium6.1 |
| CVE-2026-105150 | Product Filter for WooCommerce by WBW <= 3.4.5 - Reflected Cross-Site Scripting via 'text_no_products' Parameterwoobewoo · Product Filter for WooCommerce by WBW | Medium6.1 |
| CVE-2026-89324 | Basel Post Types <= 1.18 - Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback SaltXTemos · Basel Post Types | Critical9.8 |
| CVE-2026-115483 | Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_fileswpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | High7.5 |
| CVE-2026-84938 | Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hookthemefusion · Avada (Fusion) Builder | High7.2 |
| CVE-2026-93427 | ARMember Premium <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Registration Custom Fieldarmember · ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup | High7.2 |
| CVE-2026-100386 | Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parserthemefic · Ultra Addons for Contact Form 7 | High7.5 |
| CVE-2026-120513 | Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameterwpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | High8.2 |
| CVE-2026-76877 | WPML Multilingual CMS <= 4.9.7 - Unauthenticated Authentication Bypass in Language-per-Domain SSO via 'wpml_sso_token_domain' ParameterWPML · WPML Multilingual CMS | High8.1 |
| CVE-2026-96769 | Extend B2B - Companies and Users Management for WooCommerce <= 2.1.4 - Unauthenticated Sensitive Information Exposure in /wp/v2/aio_company REST EndpointCodup · Extend B2B - Companies and Users Management for WooCommerce | Medium5.3 |
| CVE-2026-120531 | Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameterwedevs · Subscribe2 – Form, Email Subscribers & Newsletters | High7.2 |
| CVE-2026-120579 | Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attributerealmag777 · Active Woot Products Tables for WooCommerce. 100% FREE | Medium6.4 |
| CVE-2026-109973 | Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameteroxilab · Flipbox – Awesomes Flip Boxes Image Overlay | Medium6.4 |
| CVE-2026-122041 | Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX ActionThemehigh · Checkout Field Editor for WooCommerce (Pro) | Critical9.1 |
| CVE-2026-119156 | Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]codename065 · Download Manager | High7.2 |
| CVE-2026-93429 | VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parametere4jvikwp · VikBooking Hotel Booking Engine & PMS | High7.2 |
| CVE-2026-121977 | JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Propertyjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | Medium5.4 |
| CVE-2026-120509 | Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parametershapedplugin · Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials | Medium4.7 |
| CVE-2026-115548 | Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Headerquttera · Quttera ThreatSign – Web Malware Scanner for WordPress | High7.2 |
| CVE-2026-111317 | JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Sourcejetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | High7.2 |
| CVE-2026-109214 | User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Inputwedevs · User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | High7.2 |
| CVE-2026-111370 | WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parametersosamaesh · WP Visitor Statistics (Real Time Traffic) | High7.2 |
| CVE-2026-109991 | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameterteamfunnelkit · FunnelKit Payment Gateway for Stripe WooCommerce | High7.5 |
| CVE-2026-104014 | Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalizationnaimurrahmannahid · Naimur Email OTP Verification for WooCommerce | Critical9.8 |
| CVE-2026-118050 | Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Messageantoineh · Football Pool | Medium6.4 |
| CVE-2026-118267 | WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insertPublic exploitpeterschulznl · WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | High8.1 |
| CVE-2026-123418 | Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameterandy_moyle · Church Admin | High7.2 |
| CVE-2026-121976 | Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameterwpchill · Modula Image Gallery – Photo Grid & Video Gallery | Medium6.4 |
| CVE-2026-122231 | WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Valuewestguard · WS Form LITE – Drag & Drop Contact Form Builder | High7.2 |
| CVE-2026-120685 | Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chainshapedplugin · Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials | Medium5.4 |
| CVE-2026-109230 | WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameterosamaesh · WP Visitor Statistics (Real Time Traffic) | High7.2 |
| CVE-2026-93766 | Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' ParameterHappyforms · Happyforms Pro | High7.2 |
| CVE-2026-119075 | Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkoutthemegrill · Registration Form for WooCommerce | Critical9.8 |
| CVE-2026-104746 | Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Metastylemix · Motors – Car Dealership & Classified Listings Plugin | High8.1 |
| CVE-2026-104768 | AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Optionrubengc · AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI | High7.5 |
| CVE-2026-120683 | Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parametershapedplugin · Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials | Medium5.4 |
| CVE-2026-104760 | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attributewedevs · weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | Medium6.4 |
| CVE-2026-103914 | Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameterwpvibes · Dynific Addons for Elementor (formerly Anywhere Elementor) | Medium6.5 |
| CVE-2026-119183 | JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Metajetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | High7.2 |
| CVE-2026-96565 | WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Fieldcbutlerjr · WP-Members Membership Plugin | Medium6.4 |
| CVE-2026-116751 | Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array KeysAmelia · Booking for Appointments and Events Calendar – Amelia Pro | High7.5 |
| CVE-2026-118066 | Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' ParameterPublic exploitlatepoint · Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | Critical9.1 |
| CVE-2026-122059 | WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attributempol · WP ImageViewer | Medium6.4 |
| CVE-2026-118056 | Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Parameteroxilab · Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) | Medium4.9 |
| CVE-2026-118047 | Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hooksbouey · Falang multilanguage for WordPress | Medium6.4 |
| CVE-2026-116537 | Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameterjackdewey · Link Library | High7.2 |
| CVE-2026-93755 | Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For HeaderHappyforms · Happyforms Pro | High7.2 |