Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 9,759 published records · 23 KEV · 9,759 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

9,759 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit9269.5%
High3,57237%
Med2,95330%
Low3183.3%
None120.12%
Legacy00.00%
Unscored1,97820%

Matching records by UTC month

Jul 269,759

Signal coverage

KEV-listed: 23
With a forecast: 9,759
Unknown date: 0
Unscored severity: 1,978

Share of cohort: KEV 0.24% · forecast 100% · unscored 20%.

Showing 121–140 of 9,759By severity band: Critical · 9.0–10.0 926, High · 7.0–8.9 3,572, Medium · 4.0–6.9 2,953, Low · 0.1–3.9 318, None · scored 0.0 12, Legacy · v2 only 0, Unscored · no CNA metric 1,978

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-15258

Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:09.816Z. Updated 2026-07-31T19:44:02.517Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:44 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-15209

JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:09.640Z. Updated 2026-07-31T19:45:10.724Z.

Showing 121 to 140 of 9759.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:45 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-15048

GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:09.466Z. Updated 2026-07-31T19:48:41.603Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:48 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14931

JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:09.023Z. Updated 2026-07-31T19:47:50.635Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:47 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14930

JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' supp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:08.845Z. Updated 2026-07-31T19:46:54.676Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:46 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14929

JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:08.669Z. Updated 2026-07-31T13:24:23.485Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 20:24 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14928

JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:08.494Z. Updated 2026-07-31T19:42:49.082Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:42 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14927

FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:08.298Z. Updated 2026-07-31T13:25:07.132Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 20:25 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14922

WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:08.117Z. Updated 2026-07-31T19:41:45.293Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:41 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14921

Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:07.939Z. Updated 2026-07-31T19:40:51.550Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:40 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14849

Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in the uploads directory, allowing unauthenticated users to download the exported member and payment data (including PII) while an export artifact is present.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:07.762Z. Updated 2026-07-31T13:25:56.328Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 20:25 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14847

Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR

The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowing any authenticated user with Subscriber-level access and above to disclose the payment details of any member by enumerating the payment identifier.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:07.585Z. Updated 2026-07-31T13:26:50.377Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 20:26 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14845

NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:07.409Z. Updated 2026-07-31T19:38:14.518Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:38 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14843

Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR

The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request, relying only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:07.231Z. Updated 2026-07-31T13:27:45.469Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 20:27 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14834

Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX

The Mailgun for WordPress plugin before 2.2.1 does not perform any capability or nonce check on an unauthenticated AJAX action that adds subscribers to the site owner's configured email service mailing lists, allowing unauthenticated attackers to enrol arbitrary email addresses into those lists using the owner's stored…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:07.054Z. Updated 2026-07-31T19:36:12.035Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:36 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14833

Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above (who lack the unfiltered_html capability) to store JavaScript that runs when a visitor or adm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:06.879Z. Updated 2026-07-31T13:29:02.531Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 20:29 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14830

FlxWoo < 3.1.1 - Unauthenticated Payment Bypass

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:06.450Z. Updated 2026-07-31T13:33:11.686Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 20:33 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14554

Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:06.278Z. Updated 2026-07-31T19:34:55.210Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:34 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14333

Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory

The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:06.098Z. Updated 2026-07-31T13:34:20.830Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 20:34 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14319

GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:05.924Z. Updated 2026-07-31T19:34:02.938Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:34 WIB

Official record