Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,903All CVEsplus 19,118 rejected
- 374Last 24 hours2,802 in the last 7 days
- 16,790Last 30 days1,548 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 4 | 17 | 0 | 0 | 21 | 49 |
| 2025 | 0 | 1 | 6 | 0 | 0 | 7 | 28 |
| 2024 | 0 | 4 | 12 | 0 | 0 | 16 | 21 |
| 2023 | 0 | 1 | 1 | 0 | 0 | 2 | 5 |
| 2022 | 0 | 1 | 2 | 0 | 0 | 3 | 3 |
| Title | ||
|---|---|---|
| CVE-2026-110664 | Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notescodename065 · Premium Packages – Sell Digital Products Securely | Medium6.4 |
| CVE-2026-18586 | Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'codename065 · Premium Packages – Sell Digital Products Securely | High7.2 |
| CVE-2026-103478 | Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parametercodename065 · Premium Packages – Sell Digital Products Securely | Medium6.4 |
| CVE-2026-12054 | Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parametercodename065 · Download Manager | Medium6.1 |
| CVE-2026-9696 | Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcodecodename065 · Download Manager | Medium6.4 |
| CVE-2026-103964 | Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Emailcodename065 · Download Manager | Medium4.3 |
| CVE-2026-102401 | Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attributecodename065 · Download Manager | Medium6.4 |
| CVE-2026-97338 | Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Namecodename065 · Download Manager | Medium6.4 |
| CVE-2026-93654 | Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parametercodename065 · Premium Packages – Sell Digital Products Securely | High7.2 |
| CVE-2026-92714 | Download Manager <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parametercodename065 · Download Manager | Medium6.5 |
| CVE-2026-16685 | Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attributecodename065 · Download Manager | Medium6.4 |
| CVE-2026-12800 | Premium Packages <= 6.2.0 - Unauthenticated SQL Injectioncodename065 · Premium Packages – Sell Digital Products Securely | High7.5 |
| CVE-2026-15348 | Premium Packages <= 7.0.4 - Authentication Bypass to Non-Admin via 'wpdmppdl' Parametercodename065 · Premium Packages – Sell Digital Products Securely | Medium6.3 |
| CVE-2026-15906 | Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parametercodename065 · Premium Packages – Sell Digital Products Securely | Medium6.5 |
| CVE-2026-14343 | Download Manager <= 3.3.61 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributescodename065 · Download Manager | Medium6.4 |
| CVE-2026-13733 | Download Manager <= 3.3.60 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attributecodename065 · Download Manager | Medium6.4 |
| CVE-2026-4057 | Download Manager <= 3.3.51 - Missing Authorization to Authenticated (Contributor+) Media File Protection Removalcodename065 · Download Manager | Medium4.3 |
| CVE-2026-5357 | Download Manager <= 3.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributescodename065 · Download Manager | Medium6.4 |
| CVE-2026-2571 | Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parametercodename065 · Download Manager | Medium4.3 |
| CVE-2026-1666 | Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parametercodename065 · Download Manager | Medium6.1 |
| CVE-2025-15364 | Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePasswordcodename065 · Download Manager | High7.3 |
| CVE-2025-13498 | Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosurecodename065 · Download Manager | Medium4.3 |
| CVE-2025-12177 | Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Keycodename065 · Download Manager | Medium5.3 |
| CVE-2025-10146 | Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parametercodename065 · Download Manager | Medium6.1 |
| CVE-2025-4367 | Download Manager <= 3.3.18 - Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcodecodename065 · Download Manager | Medium6.4 |
| CVE-2025-3404 | Download Manager <= 3.3.12 - Authenticated (Author+) Arbitrary File Deletioncodename065 · Download Manager | High8.8 |
| CVE-2025-3056 | Download Manager <= 3.3.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadcodename065 · Download Manager | Medium5.4 |
| CVE-2025-1785 | Download Manager <= 3.3.08 - Authenticated (Author+) Path Traversal to Limited File Overwritecodename065 · Download Manager | Medium5.4 |
| CVE-2024-11768 | Download manager <= 3.3.03 - Improper Authorization to Unauthenticated Download of Password-Protected Filescodename065 · Download Manager | Medium5.3 |
| CVE-2024-11740 | Download Manager <= 3.3.03 - Unauthenticated Arbitrary Shortcode Executioncodename065 · Download Manager | High7.3 |
| CVE-2024-11225 | Premium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_argcodename065 · Premium Packages – Sell Digital Products Securely | Medium6.1 |
| CVE-2024-10164 | Premium Packages - Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcodecodename065 · Premium Packages – Sell Digital Products Securely | Medium6.4 |
| CVE-2024-7386 | Premium Packages – Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgerycodename065 · Premium Packages – Sell Digital Products Securely | Medium4.3 |
| CVE-2024-7486 | MultiPurpose <= 1.2.0 - Authenticated (Contributor+) PHP Object Injectioncodename065 · MultiPurpose | High8.8 |
| CVE-2024-7560 | News Flash <= 1.1.0 - Authenticated (Editor+) PHP Object Injectioncodename065 · News Flash | High7.2 |
| CVE-2024-6208 | Download Manager <= 3.2.97 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecodename065 · Download Manager | Medium6.4 |
| CVE-2024-2098 | Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrarycodename065 · Download Manager | High7.5 |
| CVE-2024-1766 | Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scriptingcodename065 · Download Manager | Medium4.4 |
| CVE-2024-5266 | Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodescodename065 · Download Manager | Medium6.4 |
| CVE-2024-4001 | Download Manager <= 3.2.93 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcodecodename065 · Download Manager | Medium6.4 |
| CVE-2024-4160 | Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcodecodename065 · Download Manager | Medium6.4 |
| CVE-2024-33938 | WordPress Sliding Widgets plugin <= 1.5.0 - Broken Access Control to XSS vulnerabilitycodename065 · Sliding Widgets | Medium6.5 |
| CVE-2023-6785 | Download Manager <= 3.2.84 - Missing Authorizationcodename065 · Download Manager | Medium5.3 |
| CVE-2023-6954 | Download Manager <= 3.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecodename065 · Download Manager | Medium6.4 |
| CVE-2023-4293 | Premium Packages - Sell Digital Products Securely <= 5.7.4 - Arbitrary User Meta Update to Authenticated (Subscriber+) Privilege Escalationcodename065 · Premium Packages – Sell Digital Products Securely | High8.8 |
| CVE-2023-2305 | Download Manager <= 3.2.70 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecodename065 · Download Manager | Medium6.4 |
| CVE-2022-2436 | Download Manager <= 3.2.49 - Authenticated (Contributor+) PHAR Deserializationcodename065 · Download Manager | High8.8 |
| CVE-2022-2101 | Download Manager <= 3.2.46 - Contributor+ Cross-Site Scriptingcodename065 · Download Manager | Medium6.4 |
| CVE-2022-1985 | Download Manager <= 3.2.42 - Reflected Cross-Site Scriptingcodename065 · Download Manager | Medium6.1 |