Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 5 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,944All CVEsplus 19,118 rejected
- 380Last 24 hours2,815 in the last 7 days
- 16,801Last 30 days1,547 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 7 | 29 | 0 | 0 | 39 | 137 |
| 2025 | 4 | 8 | 32 | 0 | 0 | 44 | 98 |
| 2024 | 4 | 7 | 39 | 0 | 0 | 50 | 54 |
| 2023 | 1 | 1 | 1 | 0 | 0 | 3 | 4 |
| 2022 | 0 | 0 | 1 | 0 | 0 | 1 | 1 |
| Title | ||
|---|---|---|
| CVE-2026-118193 | GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameterstellarwp · GiveWP – Donation Plugin and Fundraising Platform | High8.8 |
| CVE-2026-97643 | GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributesstellarwp · GiveWP – Donation Plugin and Fundraising Platform | Medium6.4 |
| CVE-2026-104762 | Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attributestellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium6.4 |
| CVE-2026-97634 | Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameterstellarwp · Event Tickets and Registration | Medium6.5 |
| CVE-2026-77820 | WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attributestellarwp · WPComplete | Medium6.4 |
| CVE-2026-78159 | The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocationstellarwp · The Events Calendar | Critical9.8 |
| CVE-2026-78006 | The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Executionstellarwp · The Events Calendar | Critical9.8 |
| CVE-2026-3174 | Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Updatestellarwp · Event Tickets and Registration | High7.5 |
| CVE-2026-12843 | LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST EndpointStellarWP · LearnDash LMS | Medium5.4 |
| CVE-2026-12483 | LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload HandlerStellarWP · LearnDash LMS | High7.5 |
| CVE-2026-5510 | GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesstellarwp · GiveWP – Donation Plugin and Fundraising Platform | Medium6.4 |
| CVE-2026-9273 | Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeoverstellarwp · Membership Plugin – Kadence Memberships | Critical9.3 |
| CVE-2026-18062 | Kadence Blocks <= 3.7.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Contentstellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium6.4 |
| CVE-2026-18435 | Kadence Blocks <= 3.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attributestellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium6.4 |
| CVE-2026-14987 | GiveWP <= 4.16.3 - Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Settingstellarwp · GiveWP – Donation Plugin and Fundraising Platform | Medium6.4 |
| CVE-2026-15286 | Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publicationstellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium4.3 |
| CVE-2026-13704 | GiveWP <= 4.16.1 - Authenticated (Give Worker+) Stored Cross-Site Scripting via Sequioa Formstellarwp · GiveWP – Donation Plugin and Fundraising Platform | Medium6.4 |
| CVE-2026-11981 | GiveWP <= 4.15.3 - Cross-Site Request Forgerystellarwp · GiveWP – Donation Plugin and Fundraising Platform | Medium4.3 |
| CVE-2026-12902 | Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actionsstellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium4.3 |
| CVE-2026-12904 | Kadence Blocks <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameterstellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium4.3 |
| CVE-2026-13246 | GiveWP <= 4.16.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attributestellarwp · GiveWP – Donation Plugin and Fundraising Platform | Medium6.4 |
| CVE-2026-11357 | Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localizationstellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium4.3 |
| CVE-2026-42642 | WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerabilityStellarWP · GiveWP | Medium5.3 |
| CVE-2026-42643 | WordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerabilityStellarWP · Image Widget | Medium5.9 |
| CVE-2026-2826 | Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Uploadstellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium4.3 |
| CVE-2026-32546 | WordPress Restrict Content plugin <= 3.2.22 - Broken Access Control vulnerabilityStellarWP · Restrict Content | High7.5 |
| CVE-2026-3079 | LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' ParameterStellarWP · LearnDash LMS | Medium6.5 |
| CVE-2026-4136 | Membership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirectstellarwp · Membership Plugin – Restrict Content | Medium4.3 |
| CVE-2026-3585 | The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_importstellarwp · The Events Calendar | High7.5 |
| CVE-2026-1321 | Membership Plugin – Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level'stellarwp · Membership Plugin – Restrict Content | High8.1 |
| CVE-2026-2694 | The Events Calendar <= 6.15.16 - Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST APIstellarwp · The Events Calendar | Medium5.4 |
| CVE-2026-27056 | WordPress iThemes Sync plugin <= 3.2.8 - Broken Access Control vulnerabilityStellarWP · iThemes Sync | Medium4.3 |
| CVE-2026-2633 | Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Missing Authorization to Authenticated (Contributor+) Unauthorized Media Uploadstellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium4.3 |
| CVE-2026-1857 | Gutenberg Blocks with AI by Kadence WP <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameterstellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium4.3 |
| CVE-2026-1304 | Membership Plugin – Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settingsstellarwp · Membership Plugin – Restrict Content | Medium4.4 |
| CVE-2026-2608 | Gutenberg Blocks by Kadence Blocks <= 3.5.32 - Missing Authorizationstellarwp · Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | Medium4.3 |
| CVE-2025-15043 | The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Controlstellarwp · The Events Calendar | Medium5.4 |
| CVE-2025-14844 | Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposurestellarwp · Membership Plugin – Restrict Content | High8.2 |
| CVE-2025-69352 | WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerabilityStellarWP · The Events Calendar | Medium5.4 |
| CVE-2025-14000 | Membership Plugin – Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesstellarwp · Membership Plugin – Restrict Content | Medium6.4 |
| CVE-2025-67467 | WordPress GiveWP plugin <= 4.13.1 - Cross Site Request Forgery (CSRF) vulnerabilityStellarWP · GiveWP | Medium5.4 |
| CVE-2025-13387 | Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scriptingstellarwp · Kadence WooCommerce Email Designer | High7.2 |
| CVE-2025-13206 | GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'stellarwp · GiveWP – Donation Plugin and Fundraising Platform | High7.2 |
| CVE-2025-12633 | Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connectionstellarwp · Bookit — Booking & Appointment Calendar | High7.5 |
| CVE-2025-12192 | The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposurestellarwp · The Events Calendar | Medium5.3 |
| CVE-2025-12197 | The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via sstellarwp · The Events Calendar | High7.5 |
| CVE-2025-12175 | The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposurestellarwp · The Events Calendar | Medium4.3 |
| CVE-2025-62027 | WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerabilityStellarWP · Event Tickets | Medium5.4 |
| CVE-2025-49906 | WordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerabilityStellarWP · WPComplete | Medium5.3 |
| CVE-2025-11517 | Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypassstellarwp · Event Tickets and Registration | High7.5 |