Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,161All CVEsplus 18,875 rejected
- 813Last 24 hours3,232 in the last 7 days
- 17,422Last 30 days1,567 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 676 | 2,446 | 2,033 | 9 | 0 | 5,164 | 19,291 |
| 2025 | 420 | 2,826 | 3,742 | 18 | 0 | 7,006 | 14,127 |
| 2024 | 378 | 1,306 | 2,845 | 35 | 0 | 4,564 | 7,121 |
| 2023 | 66 | 516 | 1,555 | 9 | 0 | 2,146 | 2,557 |
| 2022 | 18 | 35 | 303 | 25 | 0 | 381 | 411 |
| 2021 | 2 | 5 | 22 | 1 | 0 | 30 | 30 |
| Title | ||
|---|---|---|
| CVE-2026-54851 | WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilityAwesomemotive · Contact Form by WPForms | High7.1 |
| CVE-2026-62000 | WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerabilityWC Lovers · WCFM Marketplace | High7.5 |
| CVE-2026-119509 | WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerabilityeranfl · ClickCease Click Fraud Protection | Medium5.3 |
| CVE-2026-97072 | WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred · myCred | Medium4.3 |
| CVE-2026-114187 | WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerabilityWPVibes · AnyWhere Elementor | Medium5.3 |
| CVE-2026-103077 | WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred · myCred | Medium4.3 |
| CVE-2026-114185 | WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityWPVibes · AnyWhere Elementor | Medium6.5 |
| CVE-2026-119485 | WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerabilityweDevs · Dokan | Medium5.3 |
| CVE-2026-39777 | WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers · WCFM Membership | Medium4.3 |
| CVE-2026-119487 | WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerabilityweDevs · Dokan | Medium5.3 |
| CVE-2026-120843 | WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerabilityBarn2 Plugins · Posts Table with Search & Sort | Medium6.5 |
| CVE-2026-114183 | WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerabilityWPVibes · AnyWhere Elementor | Medium6.5 |
| CVE-2026-116859 | WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerabilityWPMU DEV · Forminator | Medium5.3 |
| CVE-2026-116858 | WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerabilityWPMU DEV · Forminator | Medium4.3 |
| CVE-2026-39743 | WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers · WCFM Membership | Medium5.3 |
| CVE-2026-120846 | WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerabilityUncanny Owl · Uncanny Automator | Medium5.3 |
| CVE-2026-119521 | WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs · Paid Member Subscriptions | Medium6.5 |
| CVE-2026-119495 | WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerabilityWebberZone · Better Search | Medium5.3 |
| CVE-2026-66570 | WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityNickboss · WordPress File Upload | High7.1 |
| CVE-2026-119480 | WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerabilityCrocoblock · JetFormBuilder | Medium6.5 |
| CVE-2026-62048 | WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerabilityLiquid Web / StellarWP · BookIt | Critical9.3 |
| CVE-2026-118090 | WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerabilityStylemix · MasterStudy LMS | High8.8 |
| CVE-2026-118089 | WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerabilityRexTheme · Product Feed Manager | High7.2 |
| CVE-2026-118086 | WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerabilityHakan Ozevin · WP BASE Booking | High8.8 |
| CVE-2026-116862 | WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerabilityAcato · WP REST Cache | High7.5 |
| CVE-2026-116861 | WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilitywpdesk · Flexible Chat | High7.5 |
| CVE-2026-116854 | WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerabilityAguila Technologies · WP Customer Area | Medium6.5 |
| CVE-2026-116853 | WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerabilityNexcess · GiveWP | Medium6.5 |
| CVE-2026-116852 | WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerabilityMarketing Fire · Widget Options | Critical9.1 |
| CVE-2026-116851 | WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerabilityimpleCode · eCommerce Product Catalog | High7.1 |
| CVE-2026-116847 | WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilityKitae Park · Mang Board WP | High7.1 |
| CVE-2026-116410 | WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerabilitymasteriyo · Masteriyo - LMS | Medium6.5 |
| CVE-2026-116405 | WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · VikRentCar | High7.1 |
| CVE-2026-116401 | WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerabilityRealMag777 · HUSKY | High7.5 |
| CVE-2026-116386 | WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerabilityCozy Vision Technologies Pvt. Ltd. · SMS Alert Order Notifications | Critical9.8 |
| CVE-2026-115947 | WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerabilityRealMag777 · HUSKY | Medium6.5 |
| CVE-2026-115604 | WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerabilityBrainstorm Force · SureDash | Medium5.0 |
| CVE-2026-114711 | WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerabilityMultiVendorX · MultiVendorX | Medium6.5 |
| CVE-2026-107868 | WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerabilityYITHEMES · YITH WooCommerce Product Add-Ons | Medium5.3 |
| CVE-2026-105077 | WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerabilitySpacetime · Ad Inserter | High7.1 |
| CVE-2026-94175 | WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilitySaad Iqbal · All In One Login | High7.1 |
| CVE-2026-90888 | WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerabilityleadsnap · LeadSnap | Critical9.8 |
| CVE-2026-78527 | WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerabilityGS Plugins · GS Testimonial Slider | High8.8 |
| CVE-2026-73186 | WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerabilityShortPixel · Enable Media Replace | High8.8 |
| CVE-2026-54855 | WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs · Profile Builder | High7.1 |
| CVE-2026-54854 | WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerabilityCozmoslabs · Profile Builder | Medium6.3 |
| CVE-2026-54850 | WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerabilitymagepeopleteam · Booking and Rental Manager | Medium6.5 |
| CVE-2026-48201 | WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerabilityRaul P. · Fast Velocity Minify | High7.1 |
| CVE-2026-39786 | WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerabilitybookingalgorithms · BA Book Everything | High7.1 |
| CVE-2026-39738 | WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerabilityAman · FunnelKit Automations | Critical9.8 |