Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 3 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,084All CVEsplus 19,119 rejected
- 504Last 24 hours2,858 in the last 7 days
- 16,887Last 30 days1,553 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 7 | 4 | 0 | 0 | 11 | 59 |
| 2025 | 0 | 6 | 15 | 3 | 0 | 24 | 48 |
| 2024 | 1 | 5 | 12 | 1 | 0 | 19 | 24 |
| 2023 | 0 | 1 | 4 | 0 | 0 | 5 | 5 |
| Title | ||
|---|---|---|
| CVE-2026-104368 | Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Fieldwebtoffee · Export and Import Users and Customers | High8.8 |
| CVE-2026-118989 | WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via RedirectsWebToffee · Product Import Export for WooCommerce | Medium5.1 |
| CVE-2026-93746 | WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameterwebtoffee · WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels | High7.5 |
| CVE-2026-94375 | Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()webtoffee · Order Export & Order Import for WooCommerce | Medium5.3 |
| CVE-2026-97197 | WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerabilityWebToffee · WordPress Backup & Migration | High7.5 |
| CVE-2026-18027 | WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameterwebtoffee · WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels | Medium6.5 |
| CVE-2026-49056 | WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.9.4 - Sensitive Data Exposure vulnerabilityWebToffee · WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels | High7.5 |
| CVE-2026-48971 | WordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerabilityWebToffee · Product Import Export for WooCommerce | Medium4.3 |
| CVE-2026-45438 | WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerabilityWebToffee · Smart Coupons for WooCommerce | High7.5 |
| CVE-2026-32441 | WordPress Comments Import & Export plugin <= 2.4.9 - Broken Access Control vulnerabilityWebToffee · Comments Import & Export | High7.7 |
| CVE-2026-22480 | WordPress Product Feed for WooCommerce plugin <= 2.3.3 - PHP Object Injection vulnerabilityWebToffee · Product Feed for WooCommerce | High7.2 |
| CVE-2025-67599 | WordPress WebToffee eCommerce Marketing Automation plugin <= 2.1.1 - Broken Access Control vulnerabilityWebToffee · WebToffee eCommerce Marketing Automation | Medium4.3 |
| CVE-2025-66112 | WordPress Accessibility Toolkit by WebYes plugin <= 2.0.4 - Broken Access Control vulnerabilityWebToffee · Accessibility Toolkit by WebYes | Medium4.3 |
| CVE-2025-66089 | WordPress Product Feed for WooCommerce plugin <= 2.3.1 - Broken Access Control vulnerabilityWebToffee · Product Feed for WooCommerce | Medium4.3 |
| CVE-2025-64382 | WordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerabilityWebToffee · Order Export & Order Import for WooCommerce | Medium4.3 |
| CVE-2025-12113 | Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletionwebtoffee · Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images | Medium4.3 |
| CVE-2025-64358 | WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerabilityWebToffee · Smart Coupons for WooCommerce | Medium4.3 |
| CVE-2025-49287 | WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control VulnerabilityWebToffee · Product Feed for WooCommerce | Medium4.3 |
| CVE-2025-3919 | WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptingwebtoffee · Comments Import & Export | Medium6.4 |
| CVE-2025-24651 | WordPress WebToffee WP Backup and Migration plugin <= 1.5.3 - Sensitive Data Exposure vulnerabilityWebToffee · WordPress Backup & Migration | Medium5.9 |
| CVE-2025-1913 | Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameterwebtoffee · Product Import Export for WooCommerce – Import Export Product CSV Suite | High7.2 |
| CVE-2025-1911 | Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Functionwebtoffee · Product Import Export for WooCommerce – Import Export Product CSV Suite | Low2.7 |
| CVE-2025-1912 | Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Functionwebtoffee · Product Import Export for WooCommerce – Import Export Product CSV Suite | High7.6 |
| CVE-2025-1769 | Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Functionwebtoffee · Product Import Export for WooCommerce – Import Export Product CSV Suite | Medium4.9 |
| CVE-2025-1973 | Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Functionwebtoffee · Export and Import Users and Customers | Medium4.9 |
| CVE-2025-1970 | Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Functionwebtoffee · Export and Import Users and Customers | High7.6 |
| CVE-2025-1971 | Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameterwebtoffee · Export and Import Users and Customers | High7.2 |
| CVE-2025-1972 | Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Functionwebtoffee · Export and Import Users and Customers | Low2.7 |
| CVE-2024-13920 | Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Functionwebtoffee · Order Export & Order Import for WooCommerce | Medium4.9 |
| CVE-2024-13921 | Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameterwebtoffee · Order Export & Order Import for WooCommerce | High7.2 |
| CVE-2024-13922 | Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Functionwebtoffee · Order Export & Order Import for WooCommerce | Low2.7 |
| CVE-2024-13923 | Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Functionwebtoffee · Order Export & Order Import for WooCommerce | High7.6 |
| CVE-2025-24657 | WordPress Wishlist for WooCommerce plugin <=2.1.2 - Cross Site Scripting (XSS) vulnerabilityWebToffee · Wishlist for WooCommerce | Medium5.9 |
| CVE-2025-24644 | WordPress WooCommerce PDF Invoices plugin <= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerabilityWebToffee · WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels | Medium5.9 |
| CVE-2023-45636 | WordPress Backup & Migration plugin <= 1.4.1 - Broken Access Control vulnerabilityWebToffee · WordPress Backup & Migration | Medium5.4 |
| CVE-2023-33928 | WordPress WordPress Backup & Migration plugin <= 1.4.0 - Broken Access Control vulnerabilityWebToffee · WordPress Backup & Migration | Medium4.3 |
| CVE-2024-7514 | WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversalwebtoffee · Comments Import & Export | Medium6.5 |
| CVE-2023-52183 | WordPress WordPress Backup & Migration plugin <= 1.4.3 - Broken Access Control vulnerabilityWebToffee · WordPress Backup & Migration | Medium5.4 |
| CVE-2023-51546 | WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.2.1 - Privilege Escalation vulnerabilityWebToffee · WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels | High7.2 |
| CVE-2024-34751 | WordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerabilityWebToffee · Order Export & Order Import for WooCommerce | Medium4.4 |
| CVE-2024-3546 | WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversalwebtoffee · WebToffee WP Backup and Migration | Medium4.3 |
| CVE-2024-32834 | WordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerabilityWebToffee · WooCommerce Shipping Label | Medium5.9 |
| CVE-2024-32835 | WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerabilityWebToffee · Import Export WordPress Users | Medium5.4 |
| CVE-2024-31235 | WordPress Comments Import & Export plugin <= 2.3.5 - Cross Site Request Forgery (CSRF) vulnerabilityWebToffee · WordPress Comments Import & Export | Medium4.3 |
| CVE-2024-31254 | WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerabilityWebToffee · WordPress Backup & Migration | Low3.7 |
| CVE-2024-3216 | WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.2 - Missing Authorization to Unauthenticated Settings Resetwebtoffee · WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels | Medium5.3 |
| CVE-2024-30492 | WordPress Export and Import Users and Customers plugin <= 2.5.2 - Path Traversal vulnerabilityWebToffee · Import Export WordPress Users | Medium4.3 |
| CVE-2024-22288 | WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin <= 4.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityWebToffee · WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels | High7.1 |
| CVE-2024-30231 | WordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerabilityWebToffee · Product Import Export for WooCommerce | Critical9.1 |
| CVE-2024-0957 | WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site Scriptingwebtoffee · WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels | Medium6.1 |