Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,807All CVEsplus 19,141 rejected
- 473Last 24 hours3,082 in the last 7 days
- 16,902Last 30 days1,575 of them critical
- 1,769Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 0 | 15 | 28 | 1 | 0 | 44 | 114 |
| 2025 | 0 | 3 | 23 | 0 | 0 | 26 | 70 |
| 2024 | 1 | 4 | 27 | 4 | 0 | 36 | 44 |
| 2023 | 2 | 2 | 4 | 0 | 0 | 8 | 8 |
| Title | ||
|---|---|---|
| CVE-2026-120538 | Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capturesmub · Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | High8.1 |
| CVE-2026-76010 | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversalsmub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | High8.8 |
| CVE-2026-109367 | All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parametersmub · All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) | Medium5.3 |
| CVE-2026-116563 | Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTMLsmub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | Medium5.4 |
| CVE-2026-76012 | Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Uploadsmub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | High7.5 |
| CVE-2026-82814 | Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injectionsmub · Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | High8.8 |
| CVE-2026-109401 | WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Emailsmub · WP Mail Logging | Low2.7 |
| CVE-2026-97640 | WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)smub · WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) | High7.2 |
| CVE-2026-101921 | WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attributesmub · WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | Medium4.7 |
| CVE-2026-14335 | Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameterssmub · Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | High7.2 |
| CVE-2026-100152 | All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parametersmub · All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) | Medium6.5 |
| CVE-2026-85492 | All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathnamesmub · All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) | Medium6.1 |
| CVE-2026-93756 | Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Previewsmub · Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | High7.2 |
| CVE-2026-88996 | WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parametersmub · WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | Medium6.1 |
| CVE-2026-84909 | Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attributesmub · Custom Twitter Feeds – A Tweets Widget or X Feed Widget | Medium6.4 |
| CVE-2026-77189 | Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attributesmub · Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) | Medium6.5 |
| CVE-2026-3423 | Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Descriptionsmub · Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | Medium6.4 |
| CVE-2026-16775 | Smash Balloon Social Post Feed <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attributesmub · Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | Medium6.4 |
| CVE-2026-15452 | Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query Stringsmub · Smash Balloon Social Photo Feed – Easy Social Feeds Plugin | Medium4.7 |
| CVE-2026-12476 | Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parametersmub · Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | High7.2 |
| CVE-2026-15782 | WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Contentsmub · WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | Medium4.9 |
| CVE-2026-12002 | Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parametersmub · Smash Balloon Social Photo Feed – Easy Social Feeds Plugin | Medium4.7 |
| CVE-2026-12127 | WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Namesmub · WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | Medium5.3 |
| CVE-2026-8613 | aThemes Addons for Elementor <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' Widget Settingsmub · aThemes Addons for Elementor | Medium6.4 |
| CVE-2026-7792 | WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpointsmub · WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More | Medium5.3 |
| CVE-2026-10038 | Charitable <= 1.8.11.1 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parametersmub · Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More | Medium4.3 |
| CVE-2026-7526 | PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Pagesmub · PDF Embedder – PDF Viewer & Embed PDF Files for WordPress | Medium4.3 |
| CVE-2026-7533 | Easy Digital Downloads <= 3.6.7 - Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parametersmub · Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | Medium4.3 |
| CVE-2026-8832 | WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPostsmub · WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager | High8.8 |
| CVE-2026-7636 | Slider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API Endpointsmub · Slider by Soliloquy – Responsive Image Slider for WordPress | Medium4.3 |
| CVE-2026-6566 | Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST APIsmub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | Medium4.3 |
| CVE-2026-5075 | All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Datasmub · All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic | Medium4.3 |
| CVE-2026-5361 | Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via 'arrows' Parametersmub · Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | Medium6.4 |
| CVE-2026-6177 | Custom Twitter Feeds <= 2.5.4 - Unauthenticated Stored Cross-Site Scripting via Cached Tweet Textsmub · Custom Twitter Feeds – A Tweets Widget or X Feed Widget | High7.2 |
| CVE-2026-7619 | Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parametersmub · Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More | Medium6.5 |
| CVE-2026-5488 | ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'smub · ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) | Medium5.3 |
| CVE-2026-5464 | ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_processsmub · ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) | High7.2 |
| CVE-2026-3177 | Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhooksmub · Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More | Medium5.3 |
| CVE-2026-1463 | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusionsmub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | High8.8 |
| CVE-2026-1992 | ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installationsmub · ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) | High8.8 |
| CVE-2026-1993 | ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Updatesmub · ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) | High8.8 |
| CVE-2026-1236 | Envira Gallery for WordPress <= 1.12.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'justified_gallery_theme' Parameter via REST APIsmub · Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | Medium6.4 |
| CVE-2026-2471 | WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Fieldsmub · WP Mail Logging | High7.5 |
| CVE-2025-14384 | All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosuresmub · All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic | Medium4.3 |
| CVE-2025-14783 | Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirectsmub · Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | Medium4.3 |
| CVE-2025-13641 | Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'smub · Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | High8.8 |
| CVE-2025-12484 | Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scriptingsmub · Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers | High7.2 |
| CVE-2025-12847 | All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletionsmub · All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic | Medium4.3 |
| CVE-2025-12377 | Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actionssmub · Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | Medium4.3 |
| CVE-2025-11448 | Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversionsmub · Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | Medium4.3 |