Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 961–980 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-111032

Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:24.660Z. Updated 2026-10-28T17:58:06.341Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-111031

Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 961 to 980 of 16156.First page Next page

Published 2026-10-28T06:00:24.488Z. Updated 2026-10-28T17:58:06.485Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-111027

Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:24.314Z. Updated 2026-10-28T17:58:06.628Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-111021

Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:24.132Z. Updated 2026-10-28T17:58:06.765Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-110691

WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:23.955Z. Updated 2026-10-28T17:58:06.900Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-110524

Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks agai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:23.783Z. Updated 2026-10-28T17:58:07.037Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-110509

Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler

The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:23.607Z. Updated 2026-10-28T17:58:07.202Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-110507

Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and pri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:23.185Z. Updated 2026-10-28T17:58:07.345Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-110506

Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who op…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:23.013Z. Updated 2026-10-28T17:58:07.498Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-110292

PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent

The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:22.829Z. Updated 2026-10-28T17:58:07.648Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-107100

Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:22.651Z. Updated 2026-10-28T17:58:07.790Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-107098

Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:22.478Z. Updated 2026-10-28T17:58:07.940Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-107097

Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization check before using the site owner's stored Mailchimp credential to add subscriber records to an audience chosen by the request, allowing unauthenticated attackers to inject arbitrary email addresses and contact details i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:22.291Z. Updated 2026-10-28T17:58:08.091Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-106647

Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's own document or owner, instead storing it in a site-global namespace keyed only on a non-secret, author-chosen identifier that is exposed in public page source, allowing users with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:21.875Z. Updated 2026-10-28T17:58:08.236Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-106003

Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:21.700Z. Updated 2026-10-28T17:58:08.395Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-106002

Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion

The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-management actions, allowing unauthenticated users to delete arbitrary tournament-ladder challenge records, along with the linked court-booking event when one was scheduled.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:21.524Z. Updated 2026-10-28T17:58:08.549Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-105997

Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient

The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recipient to server-side state, allowing unauthenticated users to make the site send templated verification-code emails to arbitrary recipients.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:21.342Z. Updated 2026-10-28T17:58:08.731Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-105972

WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute

The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:21.162Z. Updated 2026-10-28T17:58:08.920Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-104694

Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter

The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:20.983Z. Updated 2026-10-28T17:58:09.090Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record

UnscoredPublished 28 Oct 2026, 13:00 WIB

CVE-2026-103688

Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload

The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowing unauthenticated users to upload arbitrary files, including PHP files that lead to remote code exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T06:00:20.809Z. Updated 2026-10-28T17:58:09.254Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 00:58 WIB

Official record