Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 2 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,321All CVEsplus 19,140 rejected
- 471Last 24 hours2,738 in the last 7 days
- 16,929Last 30 days1,560 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 1 | 8 | 10 | 0 | 0 | 19 | 69 |
| 2025 | 0 | 3 | 13 | 0 | 0 | 16 | 50 |
| 2024 | 0 | 3 | 14 | 0 | 0 | 17 | 34 |
| 2023 | 2 | 3 | 6 | 0 | 0 | 11 | 17 |
| 2022 | 0 | 0 | 5 | 1 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-107659 | Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPTwpchill · Modula Image Gallery – Photo Grid & Video Gallery | High7.5 |
| CVE-2026-96650 | Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Fieldwpchill · Strong Testimonials | High7.2 |
| CVE-2026-100182 | Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editorwpchill · Download Monitor | High7.2 |
| CVE-2026-89406 | Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameterswpchill · Modula Image Gallery – Photo Grid & Video Gallery | High7.5 |
| CVE-2026-92713 | Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameterwpchill · Modula Image Gallery – Photo Grid & Video Gallery | High8.1 |
| CVE-2026-92622 | Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attributewpchill · Strong Testimonials | Medium6.4 |
| CVE-2026-4559 | Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attributewpchill · Image Photo Gallery Final Tiles Grid | Medium6.4 |
| CVE-2026-16144 | Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameterwpchill · Kali Forms — Contact Form & Drag-and-Drop Builder | High8.1 |
| CVE-2026-15395 | Kali Forms <= 2.4.18 - Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Valuewpchill · Kali Forms — Contact Form & Drag-and-Drop Builder | High7.2 |
| CVE-2026-9107 | Kali Forms <= 2.4.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameterwpchill · Kali Forms — Contact Form & Drag-and-Drop Builder | Medium6.4 |
| CVE-2026-3239 | Strong Testimonials <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via testimonial_view Shortcodewpchill · Strong Testimonials | Medium6.4 |
| CVE-2026-4401 | Download Monitor <= 5.1.10 - Cross-Site Request Forgery to Download Path Deletion and Disablingwpchill · Download Monitor | Medium5.4 |
| CVE-2026-3124 | Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id'wpchill · Download Monitor | High7.5 |
| CVE-2026-3584 | Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_processwpchill · Kali Forms — Contact Form & Drag-and-Drop Builder | Critical9.8 |
| CVE-2026-1860 | Kali Forms <= 2.4.8 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposurewpchill · Kali Forms — Contact Form & Drag-and-Drop Builder | Medium4.3 |
| CVE-2026-1254 | Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editingwpchill · Modula Image Gallery – Photo Grid & Video Gallery | Medium4.3 |
| CVE-2025-14865 | Passster – Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpchill · Passster – Password Protect Pages and Content | Medium6.4 |
| CVE-2025-15466 | Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Managementwpchill · Image Photo Gallery Final Tiles Grid | Medium5.4 |
| CVE-2025-14632 | Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Uploadwpchill · Filr – Secure document library | Medium4.4 |
| CVE-2025-14426 | Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Updatewpchill · Strong Testimonials | Medium4.3 |
| CVE-2025-13693 | Image Photo Gallery Final Tiles Grid <= 3.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Settingwpchill · Image Photo Gallery Final Tiles Grid | Medium6.4 |
| CVE-2025-14455 | Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Managementwpchill · Image Photo Gallery Final Tiles Grid | Medium5.4 |
| CVE-2025-14003 | Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modificationwpchill · Modula Image Gallery – Photo Grid & Video Gallery | Medium4.3 |
| CVE-2025-13891 | Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listingwpchill · Modula Image Gallery – Photo Grid & Video Gallery | Medium6.5 |
| CVE-2025-13646 | Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Conditionwpchill · Image Gallery – Photo Grid & Video Gallery | High7.5 |
| CVE-2025-13645 | Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletionwpchill · Image Gallery – Photo Grid & Video Gallery | High7.2 |
| CVE-2025-12494 | Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Movewpchill · Modula Image Gallery – Photo Grid & Video Gallery | Medium4.3 |
| CVE-2025-11268 | Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Executionwpchill · Strong Testimonials | Medium4.3 |
| CVE-2025-10000 | Qyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File Uploadwpchill · Qyrr – simply and modern QR-Code creation | Medium6.4 |
| CVE-2025-7367 | Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fieldswpchill · Strong Testimonials | Medium6.4 |
| CVE-2024-9416 | Modula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Librarywpchill · Modula Image Gallery – Photo Grid & Video Gallery | Medium6.4 |
| CVE-2024-6261 | Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scriptingwpchill · Image Photo Gallery Final Tiles Grid | Medium6.4 |
| CVE-2024-12853 | Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Uploadwpchill · Modula Image Gallery – Photo Grid & Video Gallery | High8.8 |
| CVE-2024-12711 | RSVP and Event Management <= 2.7.13 - Missing Authorizationwpchill · RSVP and Event Management | Medium5.3 |
| CVE-2024-11282 | Passster – Password Protect Pages and Content <= 4.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposurewpchill · Passster – Password Protect Pages and Content | Medium5.3 |
| CVE-2024-11106 | Simple Restrict <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposurewpchill · Simple Restrict | Medium5.3 |
| CVE-2024-10399 | Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposurewpchill · Download Monitor | Medium4.3 |
| CVE-2024-10092 | Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulationwpchill · Download Monitor | Medium4.3 |
| CVE-2022-4972 | Download Monitor <= 4.7.51 - Missing Authorization to Unauthenticated Data Exportwpchill · Download Monitor | High7.5 |
| CVE-2022-4974 | Freemius SDK <= 2.4.2 - Missing Authorization Checksdashlabsltd · YASR – Yet Another Star Rating Plugin for WordPress | Medium6.3 |
| CVE-2024-8552 | Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enablewpchill · Download Monitor | Medium4.3 |
| CVE-2023-6491 | Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modificationwpchill · Strong Testimonials | Medium4.3 |
| CVE-2024-3269 | Download Monitor <= 4.9.13 - Missing Authorizationwpchill · Download Monitor | Medium5.4 |
| CVE-2024-32429 | WordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityWPChill · Remove Footer Credit | Medium5.9 |
| CVE-2024-2026 | Passster <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcodewpchill · Passster – Password Protect Pages and Content | Medium6.4 |
| CVE-2024-30501 | WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerabilityWPChill · Download Monitor | High7.6 |
| CVE-2024-1083 | Simple Restrict <= 1.2.6 - Missing Authorization to Sensitive Information Exposurewpchill · Simple Restrict | Medium5.3 |
| CVE-2024-1218 | Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorizationwpchill · Kali Forms — Contact Form & Drag-and-Drop Builder | Medium4.3 |
| CVE-2024-1217 | Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivationwpchill · Kali Forms — Contact Form & Drag-and-Drop Builder | High7.6 |
| CVE-2024-0616 | Passster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposurewpchill · Passster – Password Protect Pages and Content | Medium5.3 |