Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates
14,934 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.
WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability
Author SQL Injection in WP ERP <= 1.17.9 versions.
Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:22.510Z. Updated 2026-09-30T13:27:06.385Z.
WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability
Administrator SQL Injection in Estatik <= 4.3.5 versions.
Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:21.780Z. Updated 2026-09-30T13:27:11.293Z.
WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:19.627Z. Updated 2026-09-30T13:27:11.167Z.
WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:18.779Z. Updated 2026-09-30T13:27:11.041Z.
WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:17.984Z. Updated 2026-09-30T13:27:10.891Z.
WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:17.181Z. Updated 2026-09-30T13:27:10.763Z.
WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:16.378Z. Updated 2026-09-30T13:27:10.632Z.
WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:15.502Z. Updated 2026-09-30T13:27:10.504Z.
WordPress WP Store Locator plugin < 3.0.0 - Denial of Service Attack vulnerability
Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.
Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:14.658Z. Updated 2026-09-30T13:27:10.239Z.
WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:13.854Z. Updated 2026-09-30T13:27:10.375Z.
WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:13.048Z. Updated 2026-09-30T13:27:09.970Z.
WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:12.235Z. Updated 2026-09-30T13:27:06.245Z.
WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:11.419Z. Updated 2026-09-30T13:27:06.112Z.
WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:10.606Z. Updated 2026-09-30T13:17:03.818Z.
WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:09.786Z. Updated 2026-09-30T13:17:03.532Z.
WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability
Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.
Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:08.993Z. Updated 2026-09-30T13:17:03.665Z.
WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:08.189Z. Updated 2026-09-30T13:17:03.251Z.
WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.
Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:07.360Z. Updated 2026-10-17T08:26:28.978Z.
WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:06.473Z. Updated 2026-09-30T13:17:02.231Z.
WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-09-30T12:27:05.399Z. Updated 2026-09-30T13:17:02.051Z.