2026 CVE Database
Every Critical and High CVE published in 2026, with the signals you need to decide what to fix first.
15 CVEs found
| CVE | Severity | Product | Weakness | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-92895 WordPress Live2DWebCanvas | HIGH8.1 | WordPress Live2DWebCanvas | CWE-434 Unrestricted File Upload | n/a | Nov 6, 2026 |
| CVE-2026-116624 WordPress Advanced Members for ACF | HIGH8.8 | WordPress Advanced Members for ACF | CWE-269 Improper Privilege Management | n/a | Nov 6, 2026 |
| CVE-2026-114630 WordPress ELEX WordPress HelpDesk & Customer Ticketing System | CRITICAL9.1 | WordPress ELEX WordPress HelpDesk & Customer Ticketing System | CWE-22 Path Traversal | n/a | Nov 6, 2026 |
| CVE-2026-107622 WordPress BuddyForms | CRITICAL9.8 | WordPress BuddyForms | CWE-269 Improper Privilege Management | n/a | Nov 6, 2026 |
| CVE-2026-104010 WordPress WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database | HIGH7.5 | WordPress WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database | CWE-502 Deserialization of Untrusted Data | n/a | Nov 6, 2026 |
| CVE-2026-103479 WordPress Pubjet | پابجت | HIGH7.6 | WordPress Pubjet | پابجت | CWE-269 Improper Privilege Management | n/a | Nov 6, 2026 |
| CVE-2026-87964 WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels | HIGH7.2 | WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels | CWE-94 Code Injection | n/a | Nov 6, 2026 |
| CVE-2026-110776 WordPress MDTF – Meta Data and Taxonomies Filter | HIGH7.2 | WordPress MDTF – Meta Data and Taxonomies Filter | CWE-79 Cross Site Scripting | n/a | Nov 6, 2026 |
| CVE-2026-110291 WordPress Graphina – Charts and Graphs For Elementor | HIGH7.2 | WordPress Graphina – Charts and Graphs For Elementor | CWE-79 Cross Site Scripting | n/a | Nov 6, 2026 |
| CVE-2026-76124 WordPress BuddyBoss App | HIGH8.8 | WordPress BuddyBoss App | CWE-434 Unrestricted File Upload | 0.4% | Nov 3, 2026 |
| CVE-2026-120577 WordPress FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | HIGH8.1 | WordPress FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | CWE-22 Path Traversal | 0.6% | Nov 3, 2026 |
| CVE-2026-120559 WordPress Contact Form Extender for Divi Builder | HIGH7.5 | WordPress Contact Form Extender for Divi Builder | CWE-22 Path Traversal | 0.7% | Nov 3, 2026 |
| CVE-2026-120538 WordPress Easy Digital Downloads | HIGH8.1 | WordPress Easy Digital Downloads | CWE-287 Improper Authentication | 0.4% | Nov 3, 2026 |
| CVE-2026-120518 WordPress BuddyPress XProfile Image Field | CRITICAL9.1 | WordPress BuddyPress XProfile Image Field | CWE-22 Path Traversal | 0.8% | Nov 3, 2026 |
| CVE-2026-86596 WordPress s2Member | CRITICAL9.8 | WordPress s2Member | CWE-94 Code Injection | 1.5% | Nov 2, 2026 |
Your next credential
Earn your free CTEM certification.
Knowing the CVE is step one. Learn to scope, prioritize, validate and mobilize fixes with a free CTEM certification.
Free to takePublicly verifiable
Beginner / Practitioner / Program Leader
Explore certifications