Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,702All CVEsplus 19,141 rejected
- 647Last 24 hours3,003 in the last 7 days
- 17,172Last 30 days1,609 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 6 | 15 | 0 | 0 | 21 | 56 |
| 2025 | 1 | 2 | 10 | 1 | 0 | 14 | 35 |
| 2024 | 1 | 6 | 10 | 0 | 0 | 17 | 21 |
| 2023 | 0 | 2 | 2 | 0 | 0 | 4 | 4 |
| Title | ||
|---|---|---|
| CVE-2026-107630 | Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parametersaadiqbal · Email Templates Customizer and Designer for WordPress and WooCommerce | High7.5 |
| CVE-2026-93293 | Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handlersaadiqbal · Password Protected – Protect Your Site Content With a Password | Medium6.4 |
| CVE-2026-77871 | Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessaadiqbal · Post Snippets – Custom WordPress Code Snippets Customizer | Medium6.4 |
| CVE-2026-75962 | Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)saadiqbal · Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | High7.2 |
| CVE-2026-12739 | WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletionsaadiqbal · WP Easy Pay – Payment and Donation Form Builder for Square | Medium4.3 |
| CVE-2026-17149 | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attributesaadiqbal · Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | Medium6.4 |
| CVE-2026-15009 | Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parametersaadiqbal · Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | Medium6.1 |
| CVE-2026-6627 | WPFormify <= 1.1.1 - Missing Authorizationsaadiqbal · WPFormify – Stripe Payments with Form and Checkout | High8.2 |
| CVE-2026-11995 | Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action()saadiqbal · Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder | Medium5.3 |
| CVE-2026-12144 | Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parametersaadiqbal · Wholesale for WooCommerce | High8.8 |
| CVE-2026-12738 | WP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Status Modification via wpep_draft_confirm AJAX Actionsaadiqbal · WP Easy Pay – Payment and Donation form Builder for Square | Medium4.3 |
| CVE-2026-12097 | User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modificationsaadiqbal · User Management | Medium5.3 |
| CVE-2026-8607 | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attributesaadiqbal · Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | Medium6.4 |
| CVE-2026-7430 | Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Importsaadiqbal · Post Snippets – Custom WordPress Code Snippets Customizer | Medium4.4 |
| CVE-2024-13362 | Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parametersebet · Go Fetch Jobs (for WP Job Manager) | Medium6.1 |
| CVE-2026-3090 | Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'saadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | High7.2 |
| CVE-2026-2559 | Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwritesaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | Medium5.3 |
| CVE-2026-1674 | Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema()saadiqbal · Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder | Medium6.5 |
| CVE-2026-0550 | myCred <= 2.9.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcodesaadiqbal · Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | Medium6.4 |
| CVE-2026-0832 | New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosuresaadiqbal · New User Approve | High7.3 |
| CVE-2025-12718 | Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relaysaadiqbal · Quick Contact Form | Medium5.8 |
| CVE-2025-12361 | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposuresaadiqbal · Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | Medium4.3 |
| CVE-2025-12362 | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approvalsaadiqbal · Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | Medium5.3 |
| CVE-2025-12887 | Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Updatesaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | Medium5.4 |
| CVE-2025-12770 | New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Jugglingsaadiqbal · New User Approve | Medium5.3 |
| CVE-2025-11833 | Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosuresaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | Critical9.8 |
| CVE-2025-11244 | Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofingsaadiqbal · Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content | Low3.7 |
| CVE-2025-9219 | Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Updatesaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | Medium4.3 |
| CVE-2025-0818 | Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletionninjateam · File Manager Pro – Filester | Medium6.5 |
| CVE-2025-3453 | Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products <= 2.7.7 - Unauthenticated Sensitive Information Exposuresaadiqbal · Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content | Medium5.3 |
| CVE-2024-13844 | Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parametersaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | Medium4.9 |
| CVE-2024-13805 | Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploadsaadiqbal · Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | Medium6.4 |
| CVE-2024-13713 | WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injectionsaadiqbal · WPExperts Square For GiveWP | Medium6.5 |
| CVE-2025-0521 | Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scriptingsaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | High7.2 |
| CVE-2024-13333 | Advanced File Manager 5.2.12 - 5.2.13 - Authenticated (Subscriber+) Arbitrary File Uploadsaadiqbal · Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin | High7.5 |
| CVE-2024-11201 | myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcodesaadiqbal · Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | Medium6.4 |
| CVE-2024-11391 | Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Uploadsaadiqbal · Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | High7.5 |
| CVE-2024-10187 | myCred <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcodesaadiqbal · Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | Medium6.4 |
| CVE-2022-4974 | Freemius SDK <= 2.4.2 - Missing Authorization Checksdashlabsltd · YASR – Yet Another Star Rating Plugin for WordPress | Medium6.3 |
| CVE-2024-8725 | Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Limited File Uploadsaadiqbal · Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | Medium6.8 |
| CVE-2024-8126 | Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Uploadsaadiqbal · Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | High7.5 |
| CVE-2024-8704 | Advanced File Manager <= 5.2.8 - Authenticated (Administrator+) Local JavaScript File Inclusion via fma_localesaadiqbal · Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | High7.2 |
| CVE-2024-8658 | myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgradesaadiqbal · Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | Medium5.3 |
| CVE-2024-5861 | WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnectionsaadiqbal · WP Easy Pay – Payment and Donation form Builder for Square | Medium5.3 |
| CVE-2024-5598 | Advanced File Manager <= 5.2.4 - Sensitive Information Exposure via Directory Listingsaadiqbal · Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | High7.5 |
| CVE-2024-1639 | License Manager for WooCommerce <= 3.0.6 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposuresaadiqbal · License Manager for WooCommerce | Medium6.5 |
| CVE-2024-5207 | POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.9.3 - Authenticated (Administrator+) SQL Injectionsaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | High7.2 |
| CVE-2024-0437 | Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposuresaadiqbal · Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content | Medium4.3 |
| CVE-2024-0656 | Password Protected <= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scriptingsaadiqbal · Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content | Medium4.4 |
| CVE-2023-6875 | POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app APIsaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | Critical9.8 |