Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 7 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,293All CVEsplus 19,140 rejected
- 448Last 24 hours2,721 in the last 7 days
- 16,913Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 12 | 36 | 0 | 0 | 48 | 109 |
| 2025 | 1 | 9 | 32 | 0 | 0 | 42 | 61 |
| 2024 | 0 | 1 | 17 | 0 | 0 | 18 | 19 |
| 2023 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-119365 | WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Media Player Addons for Elementor – Media Player widget for WP | Medium6.5 |
| CVE-2026-118097 | WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Flash & HTML5 Video | Medium6.5 |
| CVE-2026-116849 | WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilitybPlugins · StreamCast | Medium6.5 |
| CVE-2026-48195 | WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins · PDF Poster | Medium6.5 |
| CVE-2026-52709 | WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Video Gallery Block | Medium6.5 |
| CVE-2026-109370 | Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attributebplugins · Document Embedder – let visitors read files without downloading | Medium6.4 |
| CVE-2026-116613 | Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attributebplugins · Animated Text Block – Add Typing and Looping Text Effects | High7.5 |
| CVE-2026-115966 | WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Typing Text – Give your texts many typing effects | Medium6.5 |
| CVE-2026-116400 | WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Button Block | Medium6.5 |
| CVE-2026-116398 | WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Content Slider Block | Medium6.5 |
| CVE-2026-116395 | WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins · LightBox Block | Medium6.5 |
| CVE-2026-115955 | WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Advanced Post Block - Post Grid for WordPress block editor | Medium6.5 |
| CVE-2026-115956 | WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Panorama Viewer – 360 Degree Image + Video Viewer | Medium6.5 |
| CVE-2026-115961 | WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilitybPlugins · B Slider | Medium6.5 |
| CVE-2026-115613 | WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Image Gallery block – Create and display photo gallery/photo album. | Medium6.5 |
| CVE-2026-62037 | WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Document Embedder | High7.1 |
| CVE-2026-62034 | WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Before After Image Comparison – Image comparison for WP | High7.1 |
| CVE-2026-62030 | WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerabilitybPlugins · StreamCast | High7.2 |
| CVE-2026-62027 | WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Team Section Block | High7.1 |
| CVE-2026-62044 | WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerabilitybPlugins · Super Video Player | High7.2 |
| CVE-2026-62028 | WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerabilitybPlugins · Before After Image Comparison – Image comparison for WP | Medium5.4 |
| CVE-2026-62039 | WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Html5 Audio Player | Medium6.5 |
| CVE-2026-42634 | WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Video Background Block – Use video as background in the section. | High7.1 |
| CVE-2026-104400 | WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilitybPlugins · B Blocks | Medium6.5 |
| CVE-2026-102378 | WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Parallax Section block | High7.1 |
| CVE-2026-5626 | Survey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Exportbplugins · Survey Form Block – collect answers and insights from your audience | Medium4.3 |
| CVE-2026-27422 | WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerabilitybPlugins · YT Player | Medium5.3 |
| CVE-2026-57647 | WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerabilitybPlugins · Panorama Viewer – 360 Degree Image + Video Viewer | High7.5 |
| CVE-2026-57323 | WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerabilitybPlugins · Flash & HTML5 Video | Medium5.8 |
| CVE-2026-56063 | WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerabilitybPlugins · MailChimp Block | High8.3 |
| CVE-2026-11402 | Services Section Block <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attributebplugins · Services Section Block – Showcase Service Details in Grid or Columns | Medium6.4 |
| CVE-2026-39579 | WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerabilitybPlugins · B Blocks | High8.8 |
| CVE-2026-53736 | Easy Twitter Feeds before 1.2.13 Cross-Site Request Forgery via duplicate_post Actionbplugins · Easy Twitter Feeds | Medium5.1 |
| CVE-2026-24520 | WordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerabilitybPlugins · Tiktok Feed | Medium4.3 |
| CVE-2026-27416 | WordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerabilitybPlugins · PDF Poster | Medium5.3 |
| CVE-2026-6446 | My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Actionbplugins · My Social Feeds – Social Feeds Embedder Plugin for WordPress | Medium5.4 |
| CVE-2024-13362 | Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parametersebet · Go Fetch Jobs (for WP Job Manager) | Medium6.1 |
| CVE-2026-40729 | WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerabilitybPlugins · 3D viewer – Embed 3D Models | Medium4.3 |
| CVE-2026-32489 | WordPress B Blocks plugin < 2.0.30 - Broken Access Control vulnerabilitybPlugins · B Blocks | Medium6.5 |
| CVE-2026-4120 | Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributesbplugins · Info Cards – Add Text and Media in Card Layouts | Medium6.4 |
| CVE-2026-32416 | WordPress PDF Poster plugin <= 2.4.0 - Broken Access Control vulnerabilitybPlugins · PDF Poster | Medium5.4 |
| CVE-2026-32359 | WordPress Icon List Block plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilitybPlugins · Icon List Block | Medium6.5 |
| CVE-2026-1228 | Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attributebplugins · Timeline Block – Beautiful Timeline Builder for WordPress (Vertical & Horizontal Timelines) | Medium4.3 |
| CVE-2026-1294 | All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpointbplugins · All In One Image Viewer Block – Gutenberg block to create image viewer with hyperlink | High7.2 |
| CVE-2026-1389 | Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletionbplugins · Document Embedder – Embed PDFs, Word, Excel, and Other Files | Medium4.3 |
| CVE-2026-24565 | WordPress B Accordion plugin <= 2.0.2 - Sensitive Data Exposure vulnerabilitybPlugins · B Accordion | Medium6.5 |
| CVE-2026-24383 | WordPress B Slider plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerabilitybPlugins · B Slider | Medium6.5 |
| CVE-2026-0833 | Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Linkbplugins · Team Section Block – Showcase Team Members with Layout Options | Medium6.4 |
| CVE-2025-13999 | HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgerybplugins · HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player | High7.2 |
| CVE-2025-60079 | WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerabilitybPlugins · Parallax Section block | High7.1 |