Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates
12,259 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.
WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:52.985Z. Updated 2026-09-01T14:40:50.144Z.
WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.
Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:52.324Z. Updated 2026-09-01T18:11:04.583Z.
WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:51.644Z. Updated 2026-09-01T13:51:57.100Z.
WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:50.989Z. Updated 2026-09-01T14:58:34.761Z.
WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:50.339Z. Updated 2026-09-02T17:30:08.992Z.
WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:49.689Z. Updated 2026-09-01T14:41:34.019Z.
WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.
Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:49.036Z. Updated 2026-09-01T18:12:24.672Z.
WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:48.385Z. Updated 2026-09-01T13:53:06.585Z.
WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.
Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:47.725Z. Updated 2026-09-01T14:58:43.508Z.
WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:47.073Z. Updated 2026-09-02T14:19:08.224Z.
WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:46.414Z. Updated 2026-09-01T14:41:57.600Z.
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:45.760Z. Updated 2026-09-01T18:13:13.242Z.
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:45.101Z. Updated 2026-09-01T13:54:20.076Z.
WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.
Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:44.373Z. Updated 2026-09-01T14:58:50.742Z.
WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:43.716Z. Updated 2026-09-02T14:16:01.854Z.
WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:43.061Z. Updated 2026-09-01T14:42:28.753Z.
WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability
Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.
Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:42.386Z. Updated 2026-09-01T18:09:55.563Z.
WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:41.734Z. Updated 2026-09-01T15:15:40.199Z.
WordPress MapSVG plugin <= 8.15.0 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.
Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:41.084Z. Updated 2026-09-02T14:13:37.274Z.
Wallos: OIDC state parameter never validated — login CSRF / account takeover
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into …
Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-08-31T20:30:30.913Z. Updated 2026-09-01T14:43:41.741Z.