Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,334All CVEsplus 19,141 rejected
- 442Last 24 hours2,721 in the last 7 days
- 16,921Last 30 days1,562 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 3 | 6 | 2 | 0 | 0 | 11 | 44 |
| 2025 | 1 | 4 | 11 | 0 | 0 | 16 | 33 |
| 2024 | 0 | 4 | 7 | 0 | 0 | 11 | 17 |
| 2023 | 0 | 1 | 3 | 0 | 0 | 4 | 6 |
| 2022 | 0 | 0 | 2 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-100185 | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Fieldwpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium6.4 |
| CVE-2026-17092 | Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameterwpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | High8.1 |
| CVE-2026-94499 | WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerabilitywpWax · FormGent | High7.1 |
| CVE-2026-32474 | WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerabilitywpWax · Templatiq | Critical9.9 |
| CVE-2025-15028 | FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More <= 1.9.2 - Unauthenticated Stored Cross-Site Scriptingwpwax · FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More | High7.2 |
| CVE-2026-3141 | FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameterwpwax · FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More | Critical9.1 |
| CVE-2026-59518 | WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerabilitywpWax · Directorist | Critical9.8 |
| CVE-2026-49073 | WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerabilitywpWax · Directorist Booking | High8.5 |
| CVE-2026-39509 | WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerabilitywpWax · Directorist | Medium5.3 |
| CVE-2026-22460 | WordPress FormGent plugin <= 1.7.0 - Arbitrary File Deletion vulnerabilitywpWax · FormGent | High8.6 |
| CVE-2025-68069 | WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerabilitywpWax · Directorist | High7.1 |
| CVE-2025-64250 | WordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerabilitywpWax · Directorist | Medium4.7 |
| CVE-2025-66077 | WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerabilitywpWax · Legal Pages | Medium5.3 |
| CVE-2025-12174 | Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Updatewpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium6.5 |
| CVE-2025-10488 | Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Movewpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | High8.1 |
| CVE-2025-48242 | WordPress Legal Pages plugin <= 1.4.5 - Broken Access Control VulnerabilitywpWax · Legal Pages | Medium6.5 |
| CVE-2025-32658 | WordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerabilitywpWax · HelpGent | Critical9.8 |
| CVE-2025-39525 | WordPress Logo Carousel Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) VulnerabilitywpWax · Logo Carousel Slider | Medium6.5 |
| CVE-2025-32499 | WordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerabilitywpWax · Logo Showcase Ultimate | Medium6.5 |
| CVE-2025-31857 | WordPress Directorist AddonsKit for Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilitywpWax · Directorist AddonsKit for Elementor | Medium6.5 |
| CVE-2025-2224 | Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishingwpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium5.3 |
| CVE-2025-1570 | Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTPwpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | High8.1 |
| CVE-2024-12041 | Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposurewpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium5.3 |
| CVE-2025-24782 | WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerabilitywpWax · Post Grid, Slider & Carousel Ultimate | Medium6.5 |
| CVE-2025-24681 | WordPress Product Carousel Slider & Grid Ultimate for WooCommerce Plugin <= 1.10.0 - Cross Site Scripting (XSS) vulnerabilitywpWax · Product Carousel Slider & Grid Ultimate for WooCommerce | Medium5.9 |
| CVE-2024-13408 | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusionwpwax · Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | High7.5 |
| CVE-2024-13409 | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler()wpwax · Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | High7.5 |
| CVE-2024-12040 | Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'wpwax · Product Carousel Slider & Grid Ultimate for WooCommerce | High8.8 |
| CVE-2024-44048 | WordPress Product Carousel Slider & Grid Ultimate for WooCommerce plugin <= 1.9.10 - Authenticated Local File Inclusion vulnerabilitywpWax · Product Carousel Slider & Grid Ultimate for WooCommerce | Medium6.5 |
| CVE-2024-8046 | Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadwpwax · Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid | Medium6.4 |
| CVE-2024-33929 | WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerabilitywpWax · Directorist | Medium5.3 |
| CVE-2024-32451 | WordPress Legal Pages plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerabilitywpWax · Legal Pages | Medium4.3 |
| CVE-2024-29925 | WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerabilitywpWax · Post Grid, Slider & Carousel Ultimate | Medium6.5 |
| CVE-2023-50886 | WordPress Legal Pages plugin <= 1.3.7 - CSRF + Broken Access Control vulnerabilitywpWax · Legal Pages | Medium4.3 |
| CVE-2024-1950 | Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.7 - Authenticated(Contributor+) PHP Object Injectionwpwax · Product Carousel Slider & Grid Ultimate for WooCommerce | High7.5 |
| CVE-2024-1951 | Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injectionwpwax · Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid | High7.5 |
| CVE-2024-2006 | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markupwpwax · Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | High8.8 |
| CVE-2024-1322 | Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Changewpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium5.3 |
| CVE-2023-47824 | WordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)wpWax · Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator | Medium5.4 |
| CVE-2023-41798 | WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV InjectionwpWax · Directorist – WordPress Business Directory Plugin with Classified Ads Listings | Medium5.1 |
| CVE-2023-1889 | Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_taskwpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | Medium6.5 |
| CVE-2023-1888 | Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalationwpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads | High8.8 |
| CVE-2022-34650 | WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitieswpWax · Team (WordPress plugin) | Medium4.1 |
| CVE-2022-34853 | WordPress Team plugin <= 1.2.6 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilitieswpWax · Team (WordPress plugin) | Medium4.1 |