Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read just now.
At a glance
Published CVEs; rejected ones are not counted.
- 401,582All CVEsplus 19,141 rejected
- 683Last 24 hours2,960 in the last 7 days
- 17,113Last 30 days1,610 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 2 | 9 | 15 | 0 | 0 | 26 | 61 |
| 2025 | 1 | 2 | 10 | 0 | 0 | 13 | 35 |
| 2024 | 2 | 2 | 15 | 0 | 0 | 19 | 22 |
| 2023 | 0 | 1 | 2 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-120741 | MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpointjetmonsters · MotoPress Appointment Booking | Medium5.4 |
| CVE-2026-120561 | JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modificationjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | Medium5.3 |
| CVE-2026-103912 | JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Rendererjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | Medium4.7 |
| CVE-2026-91862 | Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'jetmonsters · Getwid – Gutenberg Blocks | Medium6.4 |
| CVE-2026-97342 | JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Actionjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | High7.2 |
| CVE-2026-102391 | WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerabilityjetmonsters · JetFormBuilder | High7.1 |
| CVE-2026-96568 | Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameterjetmonsters · Restaurant Menu and Food Ordering | High7.2 |
| CVE-2026-92212 | JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Fieldjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | Medium6.1 |
| CVE-2026-5924 | Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'jetmonsters · Getwid – Gutenberg Blocks | Medium6.4 |
| CVE-2026-12793 | JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameterjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | Critical9.8 |
| CVE-2026-90650 | MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'jetmonsters · MotoPress Hotel Booking | High7.2 |
| CVE-2026-73400 | WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerabilityjetmonsters · Restaurant Menu by MotoPress | High8.1 |
| CVE-2026-28140 | WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerabilityjetmonsters · JetFormBuilder | High7.5 |
| CVE-2026-9180 | MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameterjetmonsters · MotoPress Appointment Booking | Medium5.3 |
| CVE-2026-57347 | WordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerabilityjetmonsters · Hotel Booking Lite | Medium6.5 |
| CVE-2026-13459 | JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameterjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | Medium5.3 |
| CVE-2026-13454 | MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameterjetmonsters · MotoPress Appointment Booking | Medium6.5 |
| CVE-2026-11380 | JetWidgets For Elementor <= 1.0.21 - Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Settingjetmonsters · JetWidgets For Elementor | Medium6.4 |
| CVE-2026-57644 | WordPress Restaurant Menu by MotoPress plugin <= 2.4.10 - SQL Injection vulnerabilityjetmonsters · Restaurant Menu by MotoPress | High8.5 |
| CVE-2025-63078 | WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerabilityjetmonsters · Restaurant Menu by MotoPress | Medium4.3 |
| CVE-2026-54196 | WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerabilityJetmonsters · JetFormBuilder | Medium6.8 |
| CVE-2026-54195 | WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerabilityJetmonsters · JetFormBuilder | High7.1 |
| CVE-2026-9228 | Timetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Functionjetmonsters · Timetable and Event Schedule by MotoPress | Medium4.3 |
| CVE-2026-8684 | MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Actionjetmonsters · MotoPress Hotel Booking | Medium5.3 |
| CVE-2026-32525 | WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerabilityjetmonsters · JetFormBuilder | Critical9.9 |
| CVE-2026-4373 | JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Fieldjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | High7.5 |
| CVE-2025-69013 | WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerabilityjetmonsters · Stratum | Medium4.3 |
| CVE-2025-66078 | WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerabilityjetmonsters · Hotel Booking Lite | Critical9.1 |
| CVE-2025-49914 | WordPress Restaurant Menu by MotoPress plugin <= 2.4.7 - Sensitive Data Exposure vulnerabilityjetmonsters · Restaurant Menu by MotoPress | Medium6.5 |
| CVE-2025-11991 | JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generationjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | Medium5.3 |
| CVE-2025-8195 | JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgetsjetmonsters · JetWidgets For Elementor | Medium6.4 |
| CVE-2025-64384 | WordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerabilityjetmonsters · JetFormBuilder | Medium5.3 |
| CVE-2025-58252 | WordPress Getwid Plugin <= 2.1.2 - Sensitive Data Exposure Vulnerabilityjetmonsters · Getwid | Medium4.3 |
| CVE-2025-7845 | Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgetsjetmonsters · Stratum Widgets for Elementor | Medium6.4 |
| CVE-2025-54038 | WordPress Restaurant Menu by MotoPress plugin <= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerabilityjetmonsters · Restaurant Menu by MotoPress | Medium5.4 |
| CVE-2025-53990 | WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerabilityjetmonsters · JetFormBuilder | High7.2 |
| CVE-2025-48258 | WordPress Mega Menu Block plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerabilityjetmonsters · Mega Menu Block | Medium6.5 |
| CVE-2025-30846 | WordPress Restaurant Menu by MotoPress plugin <= 2.4.4 - Local File Inclusion vulnerabilityjetmonsters · Restaurant Menu by MotoPress | High8.8 |
| CVE-2024-13642 | Stratum – Elementor Widgets <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting Vulnerability via Image Hotspot Widgetjetmonsters · Stratum Widgets for Elementor | Medium6.4 |
| CVE-2024-5020 | Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Libraryextendthemes · Colibri Page Builder | Medium6.4 |
| CVE-2024-10316 | Stratum – Elementor Widgets <= 1.4.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatesjetmonsters · Stratum Widgets for Elementor | Medium4.3 |
| CVE-2024-10872 | Getwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scriptingjetmonsters · Getwid – Gutenberg Blocks | Medium6.4 |
| CVE-2024-10323 | JetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadjetmonsters · JetWidgets For Elementor | Medium6.4 |
| CVE-2020-36840 | Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorizationjetmonsters · Timetable and Event Schedule by MotoPress | High7.3 |
| CVE-2024-7291 | JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalationjetmonsters · JetFormBuilder — Dynamic Blocks Form Builder | High7.2 |
| CVE-2024-6489 | Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key updatejetmonsters · Getwid – Gutenberg Blocks | Medium5.3 |
| CVE-2024-6491 | Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key updatejetmonsters · Getwid – Gutenberg Blocks | Medium4.3 |
| CVE-2024-4626 | JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parametersjetmonsters · JetWidgets For Elementor | Medium6.4 |
| CVE-2024-5611 | Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widgetjetmonsters · Stratum Widgets for Elementor | Medium6.4 |
| CVE-2024-4413 | Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injectionjetmonsters · MotoPress Hotel Booking | Critical9.8 |