Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4541–4560 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18051

W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the sam…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:18.573Z. Updated 2026-08-19T16:44:12.841Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:44 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18031

TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 4541 to 4560 of 12259.First page Next page

Published 2026-08-19T06:00:18.400Z. Updated 2026-08-19T17:10:10.543Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 00:10 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-17565

Animation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request Forgery

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:18.230Z. Updated 2026-08-19T18:09:30.528Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:09 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-16979

SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:17.806Z. Updated 2026-08-19T18:08:30.359Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:08 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-16950

Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:17.567Z. Updated 2026-08-19T18:07:47.631Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 01:07 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-16617

Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:17.365Z. Updated 2026-08-19T17:49:46.832Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 00:49 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-16616

Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure and potential site takeo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:17.192Z. Updated 2026-08-19T17:47:16.763Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 00:47 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-16570

NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:17.019Z. Updated 2026-08-19T14:07:09.716Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:07 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-16058

YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration

The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and withdrawal histories by iter…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:16.840Z. Updated 2026-08-19T13:26:56.420Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:26 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-15253

Easy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment Title

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a higher privileged user who …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:16.637Z. Updated 2026-08-19T13:26:18.694Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:26 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-14861

User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:16.169Z. Updated 2026-08-19T13:15:28.942Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:15 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-14826

Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient add…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:15.994Z. Updated 2026-08-19T13:14:55.802Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:14 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-14825

Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:15.804Z. Updated 2026-08-19T13:14:24.772Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:14 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-14334

Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary Jav…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:15.621Z. Updated 2026-08-19T16:16:50.277Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:16 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-14287

TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the bro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:15.446Z. Updated 2026-08-19T12:59:30.384Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 19:59 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-14196

WCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDOR

The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:15.253Z. Updated 2026-08-19T12:58:15.379Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 19:58 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-13175

Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:14.840Z. Updated 2026-08-19T12:57:42.488Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 19:57 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-13174

Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:14.636Z. Updated 2026-08-19T12:57:08.978Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 19:57 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-13173

Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:14.418Z. Updated 2026-08-19T12:55:10.293Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 19:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-13169

Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including administrators.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:14.210Z. Updated 2026-08-19T12:54:29.588Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 19:54 WIB

Official record