Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,283All CVEsplus 19,140 rejected
- 448Last 24 hours2,726 in the last 7 days
- 16,929Last 30 days1,556 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 15 | 18 | 0 | 0 | 33 | 93 |
| 2025 | 0 | 4 | 18 | 1 | 0 | 23 | 60 |
| 2024 | 0 | 5 | 20 | 1 | 0 | 26 | 37 |
| 2023 | 0 | 1 | 4 | 0 | 0 | 5 | 11 |
| 2022 | 0 | 2 | 4 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-119176 | CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parametercodepeople · CP Multi View Events Calendar | Medium6.4 |
| CVE-2026-111727 | Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parametercodepeople · Appointment Booking Calendar | Medium6.4 |
| CVE-2026-115497 | Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parametercodepeople · Music Store – WordPress eCommerce | High7.5 |
| CVE-2026-112379 | WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerabilityCodepeople · Contact Form Email | High7.1 |
| CVE-2026-110701 | CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parametercodepeople · CP Multi View Events Calendar | High7.2 |
| CVE-2026-109901 | WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerabilityCodepeople · CP Multi View Event Calendar | High8.5 |
| CVE-2026-95598 | WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilitycodepeople · Search in Place | High7.1 |
| CVE-2026-103909 | Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equationcodepeople · Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More | Medium6.1 |
| CVE-2026-100184 | Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Valuecodepeople · Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More | Medium4.7 |
| CVE-2026-96573 | Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderercodepeople · Appointment Hour Booking – Booking Calendar | High7.2 |
| CVE-2026-100179 | Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()codepeople · Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More | Medium6.1 |
| CVE-2026-93624 | WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerabilitycodepeople · Music Player for WooCommerce | High7.2 |
| CVE-2026-95529 | WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerabilitycodepeople · Calculated Fields Form | High7.1 |
| CVE-2026-78283 | WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerabilitycodepeople · Music Player for WooCommerce | High7.1 |
| CVE-2026-78281 | WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilitycodepeople · CP Media Player | High7.1 |
| CVE-2026-66679 | WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerabilitycodepeople · Appointment Hour Booking | Medium6.5 |
| CVE-2026-65514 | WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerabilitycodepeople · Appointment Hour Booking | Medium6.5 |
| CVE-2026-57670 | WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityCodepeople · Google Maps CP | High7.1 |
| CVE-2026-12113 | Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosurecodepeople · Appointment Booking Calendar | Medium4.3 |
| CVE-2026-13335 | CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Metacodepeople · CodePeople Post Map for Google Maps | Medium6.4 |
| CVE-2026-12111 | Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parametercodepeople · Appointment Booking Calendar | Medium4.3 |
| CVE-2026-48882 | WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerabilitycodepeople · WP Time Slots Booking Form | High8.5 |
| CVE-2026-40791 | WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerabilitycodepeople · WP Time Slots Booking Form | High7.1 |
| CVE-2026-6810 | Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeovercodepeople · Booking Calendar Contact Form | Medium5.3 |
| CVE-2026-32483 | WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerabilitycodepeople · Contact Form Email | Medium6.5 |
| CVE-2026-25465 | WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerabilitycodepeople · CP Multi View Event Calendar | Medium6.5 |
| CVE-2026-32433 | WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerabilitycodepeople · CP Contact Form with Paypal | High8.5 |
| CVE-2026-32432 | WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerabilitycodepeople · WP Time Slots Booking Form | Medium5.3 |
| CVE-2026-3986 | Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settingscodepeople · Calculated Fields Form | Medium6.4 |
| CVE-2026-25368 | WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerabilitycodepeople · Calculated Fields Form | Medium6.5 |
| CVE-2026-1083 | Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configurationcodepeople · Appointment Hour Booking – Booking Calendar | Medium4.4 |
| CVE-2026-0684 | CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Importcodepeople · CP Image Store with Slideshow | Medium4.3 |
| CVE-2025-68850 | WordPress Sell Downloads plugin <= 1.1.12 - Broken Access Control vulnerabilitycodepeople · Sell Downloads | High7.5 |
| CVE-2025-68569 | WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerabilitycodepeople · WP Time Slots Booking Form | Medium6.5 |
| CVE-2025-10019 | WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerabilitycodepeople · Contact Form Email | Medium6.5 |
| CVE-2025-13318 | Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parametercodepeople · Booking Calendar Contact Form | Medium5.3 |
| CVE-2025-13384 | CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmationcodepeople · CP Contact Form with PayPal | High7.5 |
| CVE-2025-13317 | Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parametercodepeople · Appointment Booking Calendar | Medium5.3 |
| CVE-2025-64369 | WordPress Contact Form Email plugin <= 1.3.58 - Broken Access Control vulnerabilitycodepeople · Contact Form Email | Medium6.5 |
| CVE-2025-64261 | WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerabilitycodepeople · Appointment Booking Calendar | Medium5.4 |
| CVE-2025-58009 | WordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerabilitycodepeople · CP Multi View Event Calendar | Low3.8 |
| CVE-2025-48231 | WordPress Booking Calendar Contact Form plugin <= 1.2.58 - Cross Site Scripting (XSS) Vulnerabilitycodepeople · Booking Calendar Contact Form | Medium6.5 |
| CVE-2025-50025 | WordPress CP Polls plugin <= 1.0.81 - Cross Site Scripting (XSS) vulnerabilitycodepeople · CP Polls | Medium5.9 |
| CVE-2025-49332 | WordPress WP Time Slots Booking Form plugin <= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerabilitycodepeople · WP Time Slots Booking Form | Medium4.3 |
| CVE-2025-49291 | WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerabilitycodepeople · Calculated Fields Form | Medium4.3 |
| CVE-2025-47472 | WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerabilitycodepeople · Music Player for WooCommerce | Medium5.4 |
| CVE-2025-46247 | WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerabilitycodepeople · Appointment Booking Calendar | Medium5.3 |
| CVE-2025-46241 | WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerabilitycodepeople · Appointment Booking Calendar | High8.2 |
| CVE-2025-39562 | WordPress Payment Form for PayPal Pro plugin <= 1.1.72 - Cross Site Scripting (XSS) Vulnerabilitycodepeople · Payment Form for PayPal Pro | Medium5.9 |
| CVE-2024-13758 | CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgerycodepeople · CP Contact Form with PayPal | Medium6.5 |