Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 941–960 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 28 Oct 2026, 13:45 WIB

CVE-2026-109385

UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL

The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in all versions up to, and including, 5.3.0 due to insufficient input sanit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:45:07.291Z. Updated 2026-10-29T01:41:54.439Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:41 WIB

Official record

MedPublished 28 Oct 2026, 13:45 WIB

CVE-2026-103996

If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 941 to 960 of 16156.First page Next page

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:45:06.903Z. Updated 2026-10-28T16:10:28.642Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:10 WIB

Official record

HighPublished 28 Oct 2026, 13:45 WIB

CVE-2026-110662

MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating

The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:45:06.494Z. Updated 2026-10-29T01:41:54.592Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:41 WIB

Official record

HighPublished 28 Oct 2026, 13:45 WIB

CVE-2026-109381

Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:45:05.954Z. Updated 2026-10-28T16:10:34.580Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:10 WIB

Official record

MedPublished 28 Oct 2026, 13:45 WIB

CVE-2026-103370

Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with cust…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:45:05.565Z. Updated 2026-10-29T01:41:54.736Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:41 WIB

Official record

MedPublished 28 Oct 2026, 13:45 WIB

CVE-2026-116609

WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the user-supplied attribute a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:45:04.986Z. Updated 2026-10-29T01:41:54.871Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:41 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-115281

Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:27.397Z. Updated 2026-10-28T17:58:03.936Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-115255

WP Roster < 2.35 - Unauthenticated Roster Member Deletion

The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:27.222Z. Updated 2026-10-28T17:58:04.092Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-115225

Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup

The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are rea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:27.049Z. Updated 2026-10-28T17:58:04.260Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-115224

Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding

The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:26.878Z. Updated 2026-10-28T17:58:04.411Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-113813

PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCom…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:26.467Z. Updated 2026-10-28T17:58:04.601Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-113494

GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:26.281Z. Updated 2026-10-28T17:58:04.748Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-113488

GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, includ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:26.104Z. Updated 2026-10-28T17:58:04.973Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-113487

GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute

The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:25.932Z. Updated 2026-10-28T17:58:05.133Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-113486

Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF

The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:25.753Z. Updated 2026-10-28T17:58:05.308Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-113485

Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF

The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:25.578Z. Updated 2026-10-28T17:58:05.466Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-111967

MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pendin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:25.402Z. Updated 2026-10-28T17:58:05.640Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-111961

Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:25.225Z. Updated 2026-10-28T17:58:05.821Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-111960

Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:25.046Z. Updated 2026-10-28T17:58:06.002Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-111577

GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:24.868Z. Updated 2026-10-28T17:58:06.169Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record