Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,986All CVEsplus 19,118 rejected
- 418Last 24 hours2,844 in the last 7 days
- 16,806Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 8 | 4 | 0 | 0 | 13 | 39 |
| 2025 | 0 | 1 | 9 | 0 | 0 | 10 | 26 |
| 2024 | 3 | 3 | 9 | 0 | 0 | 15 | 16 |
| 2023 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-111838 | WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerabilityThemeHunk · ThemeHunk Customizer | High7.1 |
| CVE-2026-105883 | WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerabilityThemeHunk · Th Shop Mania | High7.1 |
| CVE-2026-66607 | WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityThemeHunk · Advance Product Search | High7.1 |
| CVE-2026-12753 | Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameterthemehunk · Advance Product Search- Voice & Ajax Search for WooCommerce | High7.5 |
| CVE-2026-57405 | WordPress Open Shop theme <= 1.7.1 - Broken Access Control vulnerabilitythemehunk · Open Shop | High7.1 |
| CVE-2026-14250 | Themehunk Login Registration <= 1.0.2 - Unauthenticated Privilege Escalation via 'role' Parameterthemehunk · TH Login Registration | Medium6.3 |
| CVE-2026-56070 | WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerabilityThemeHunk · Advance Product Search | Critical9.3 |
| CVE-2023-25969 | WordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerabilityThemeHunk · Contact Form & Lead Form Elementor Builder | Medium5.4 |
| CVE-2026-32532 | WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityThemeHunk · Contact Form & Lead Form Elementor Builder | High7.1 |
| CVE-2026-25438 | WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeHunk · Gutenberg Blocks | High7.1 |
| CVE-2026-1454 | Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scriptingthemehunk · Lead Form Builder & Contact Form | High7.2 |
| CVE-2025-68046 | WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerabilityThemeHunk · Contact Form & Lead Form Elementor Builder | Medium6.5 |
| CVE-2025-69344 | WordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerabilitythemehunk · Oneline Lite | Medium4.3 |
| CVE-2025-12040 | Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulationthemehunk · Wishlist for WooCommerce | Medium6.5 |
| CVE-2025-62902 | WordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerabilityThemeHunk · WP Popup Builder | Medium5.3 |
| CVE-2025-9378 | Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributesthemehunk · Vayu Blocks – Website Builder for the Block Editor | Medium6.4 |
| CVE-2025-52816 | WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerabilitythemehunk · Zita | High8.1 |
| CVE-2025-30990 | WordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerabilityThemeHunk · ThemeHunk | Medium4.3 |
| CVE-2025-4420 | Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameterthemehunk · Vayu Blocks – Website Builder for the Block Editor | Medium6.4 |
| CVE-2025-2568 | Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Updatethemehunk · Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce | Medium5.3 |
| CVE-2025-22644 | WordPress Vayu Blocks – Gutenberg Blocks plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerabilityThemeHunk · Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce | Medium6.5 |
| CVE-2025-30881 | WordPress Big Store theme <= 2.0.8 - Broken Access Control vulnerabilitythemehunk · Big Store | Medium4.3 |
| CVE-2024-13511 | Variation Swatches for WooCommerce 1.0.8 - 1.3.2 - Cross-Site Request Forgery to Plugin Settings Resetthemehunk · Variation Swatches for WooCommerce | Medium4.3 |
| CVE-2024-54369 | WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerabilityThemeHunk · Zita Site Builder | Critical9.1 |
| CVE-2024-10124 | Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activationthemehunk · Vayu Blocks – Website Builder for the Block Editor | Critical9.8 |
| CVE-2023-28688 | WordPress TH Variation Swatches plugin <= 1.2.7 - Cross-Site Request Forgery (CSRF) vulnerabilityThemeHunk · TH Variation Swatches | Medium5.4 |
| CVE-2024-10674 | Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activationthemehunk · Th Shop Mania | High8.8 |
| CVE-2024-10673 | Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activationthemehunk · Top Store | High8.8 |
| CVE-2024-9061 | WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Addthemehunk · WP Popup Builder – Popup Forms and Marketing Lead Generation | High7.3 |
| CVE-2024-9707 | Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activationthemehunk · Hunk Companion | Critical9.8 |
| CVE-2024-8433 | Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scriptingthemehunk · Easy Mega Menu for WordPress – ThemeHunk | Medium6.4 |
| CVE-2024-8434 | Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Settings Updatesthemehunk · Easy Mega Menu for WordPress – ThemeHunk | Medium4.3 |
| CVE-2024-44049 | WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerabilityThemeHunk · Gutenberg Blocks | Medium6.5 |
| CVE-2024-4261 | Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.1 - Authenticated (Subscriber+) Arbitrary Shortcode Executionthemehunk · Lead Form Builder & Contact Form | Medium5.4 |
| CVE-2022-40218 | WordPress TH Advance Product Search plugin <= 1.1.4 - Unauthenticated Plugin Settings Change vulnerabilityThemeHunk · Advance WordPress Search Plugin | Medium6.5 |
| CVE-2024-1415 | Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Cross-Site Request Forgerythemehunk · Lead Form Builder & Contact Form | Medium4.3 |
| CVE-2024-1416 | Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Missing Authorizationthemehunk · Lead Form Builder & Contact Form | Medium4.3 |
| CVE-2022-38057 | WordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerabilityThemeHunk · Advance WordPress Search Plugin | Medium6.5 |
| CVE-2023-27431 | WordPress Big Store Theme <= 1.9.3 is vulnerable to Cross Site Request Forgery (CSRF)ThemeHunk · Big Store | Medium4.3 |