Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 6 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,298All CVEsplus 19,140 rejected
- 452Last 24 hours2,722 in the last 7 days
- 16,915Last 30 days1,557 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 4 | 12 | 0 | 0 | 17 | 62 |
| 2025 | 0 | 6 | 8 | 0 | 0 | 14 | 45 |
| 2024 | 0 | 0 | 25 | 0 | 0 | 25 | 31 |
| 2023 | 0 | 0 | 5 | 0 | 0 | 5 | 6 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 1 |
| 2021 | 0 | 1 | 0 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-92294 | Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parametersbrainstormforce · Spectra Legacy – Gutenberg Blocks | Medium6.5 |
| CVE-2026-96870 | SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameterbrainstormforce · SureDash – Community, Courses & Member Dashboard | Medium6.4 |
| CVE-2026-102774 | SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Contentbrainstormforce · SureDash – Community, Courses & Member Dashboard | Medium6.4 |
| CVE-2026-16302 | Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposurebrainstormforce · Spectra Legacy – Gutenberg Blocks | Medium4.3 |
| CVE-2026-18406 | SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payloadbrainstormforce · SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz | High7.2 |
| CVE-2026-18402 | SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attributebrainstormforce · SureDash – Community, Courses & Member Dashboard | Medium6.4 |
| CVE-2026-7623 | SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attributebrainstormforce · SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz | Medium6.4 |
| CVE-2026-15821 | SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesbrainstormforce · SureDash – Community, Courses & Member Dashboard | Medium6.4 |
| CVE-2026-15787 | Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributesbrainstormforce · Ultimate Addons for Elementor | Medium6.4 |
| CVE-2026-12900 | Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Blockbrainstormforce · Spectra Legacy – Gutenberg Blocks | Medium6.4 |
| CVE-2026-15288 | SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulationbrainstormforce · SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator | High7.5 |
| CVE-2026-7465 | Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributesbrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | High8.8 |
| CVE-2026-9065 | Surecart - SQL Injectionbrainstormforce · Surecart | Critical9.3 |
| CVE-2026-4987 | SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'brainstormforce · SureForms – Contact Form, Payment Form & Other Custom Form Builder | High7.5 |
| CVE-2026-3534 | Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Metabrainstormforce · Astra | Medium6.4 |
| CVE-2026-0950 | Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Databrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | Medium5.3 |
| CVE-2025-14351 | Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletionbrainstormforce · Custom Fonts – Host Your Fonts Locally | Medium5.3 |
| CVE-2025-14855 | SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scriptingbrainstormforce · SureForms – Contact Form, Payment Form & Other Custom Form Builder | High7.2 |
| CVE-2025-13065 | Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypassbrainstormforce · Starter Templates – AI-Powered Templates for Elementor & Gutenberg | High8.8 |
| CVE-2025-13516 | SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Uploadbrainstormforce · SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers | High8.1 |
| CVE-2025-12535 | SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distributionbrainstormforce · SureForms – Contact Form, Payment Form & Other Custom Form Builder | Medium5.3 |
| CVE-2025-12536 | SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposurebrainstormforce · SureForms – Contact Form, Payment Form & Other Custom Form Builder | Medium5.3 |
| CVE-2025-11162 | Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSSbrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | Medium6.4 |
| CVE-2025-10732 | SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosurebrainstormforce · SureForms – Contact Form, Payment Form & Other Custom Form Builder | Medium4.3 |
| CVE-2025-10489 | SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creationbrainstormforce · SureForms – Contact Form, Payment Form & Other Custom Form Builder | Medium4.3 |
| CVE-2025-8488 | Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Updatebrainstormforce · Ultimate Addons for Elementor | Medium4.3 |
| CVE-2025-6691 | SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletionbrainstormforce · SureForms – Drag and Drop Form Builder for WordPress | High8.1 |
| CVE-2025-6742 | SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletionbrainstormforce · SureForms – Drag and Drop Form Builder for WordPress | High7.5 |
| CVE-2025-3102 | SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creationbrainstormforce · OttoKit: All-in-One Automation Platform | High8.1 |
| CVE-2025-1784 | Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | Medium6.4 |
| CVE-2024-12713 | SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosurebrainstormforce · SureForms – Contact Form, Payment Form & Other Custom Form Builder | Medium5.3 |
| CVE-2024-11230 | Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widgetbrainstormforce · Ultimate Addons for Elementor | Medium6.4 |
| CVE-2024-10484 | Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widgetbrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | Medium6.4 |
| CVE-2024-10325 | Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadbrainstormforce · Ultimate Addons for Elementor | Medium6.4 |
| CVE-2024-10050 | Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcodebrainstormforce · Ultimate Addons for Elementor | Medium4.3 |
| CVE-2024-4632 | WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce · CartFlows – Funnel Builder & Checkout Plugin for WooCommerce | Medium6.4 |
| CVE-2024-5757 | Elementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widgetbrainstormforce · Ultimate Addons for Elementor | Medium6.4 |
| CVE-2024-5485 | SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcodebrainstormforce · OttoKit: All-in-One Automation Platform | Medium6.4 |
| CVE-2024-4366 | Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scriptingbrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | Medium6.4 |
| CVE-2024-1332 | Custom Fonts – Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scriptingbrainstormforce · Custom Fonts – Host Your Fonts Locally | Medium6.4 |
| CVE-2024-2618 | Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce · Ultimate Addons for Elementor | Medium6.4 |
| CVE-2024-1814 | Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Blockbrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | Medium6.4 |
| CVE-2024-1815 | Spectra – WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Blockbrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | Medium6.4 |
| CVE-2024-2619 | Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injectionbrainstormforce · Ultimate Addons for Elementor | Medium5.0 |
| CVE-2024-4634 | Elementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce · Ultimate Addons for Elementor | Medium6.4 |
| CVE-2024-4630 | Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingbrainstormforce · Starter Templates – AI-Powered Templates for Elementor & Gutenberg | Medium6.4 |
| CVE-2024-1467 | Starter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgerybrainstormforce · Starter Templates – AI-Powered Templates for Elementor & Gutenberg | Medium4.3 |
| CVE-2024-3107 | Spectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversalbrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | Medium4.3 |
| CVE-2024-2347 | Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Namebrainstormforce · Astra | Medium6.4 |
| CVE-2023-6486 | Spectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSSbrainstormforce · Spectra Gutenberg Blocks – Website Builder for the Block Editor | Medium6.4 |