Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates
14,934 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.
WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:12.615Z. Updated 2026-09-30T13:27:15.802Z.
WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:11.854Z. Updated 2026-09-30T13:27:15.676Z.
WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:11.079Z. Updated 2026-09-30T13:27:15.543Z.
WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.
Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:10.327Z. Updated 2026-09-30T13:27:08.648Z.
WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:08.717Z. Updated 2026-09-30T13:27:08.380Z.
WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:07.760Z. Updated 2026-09-30T13:37:17.941Z.
WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:06.973Z. Updated 2026-09-30T13:27:17.094Z.
WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:06.228Z. Updated 2026-09-30T13:27:16.950Z.
WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:05.461Z. Updated 2026-09-30T13:27:16.830Z.
WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.
Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:04.695Z. Updated 2026-10-20T13:59:39.610Z.
WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability
Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.
Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:03.954Z. Updated 2026-09-30T13:27:08.243Z.
WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:03.190Z. Updated 2026-09-30T13:27:08.110Z.
WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:02.395Z. Updated 2026-09-30T13:27:07.953Z.
WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability
Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.
Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:01.650Z. Updated 2026-09-30T13:27:15.413Z.
WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:00.895Z. Updated 2026-09-30T13:27:15.143Z.
WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:28:00.148Z. Updated 2026-09-30T13:27:15.282Z.
WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:59.387Z. Updated 2026-09-30T13:27:15.004Z.
WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:58.524Z. Updated 2026-09-30T13:27:14.865Z.
WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:57.787Z. Updated 2026-10-22T16:52:23.467Z.
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:56.815Z. Updated 2026-09-30T13:27:14.608Z.