Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-118083 | 7.5 high | 0.00% | themeum, wp crowdfunding | Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. | 17 h ago |
| CVE-2026-42692 | 7.1 high | 0.00% | themeum, wp crowdfunding | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | Thu 29 Oct |
| CVE-2025-10186 | 5.3 medium | 0.00% | no CPE yet | The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the remove_row function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete rows from the wp_wdplugin_style table. | 8 Oct |
| CVE-2026-75930 | 4.3 medium | 0.00% | no CPE yet | The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary posts and pages — overwriting title and content, and seizing ownership by supplying an attacker-controlled post_author integer that bypasses wp_kses_post sanitization. The wp_rest nonce required by the handler is trivially obtainable by any logged-in user via /wp-admin/admin-ajax.php?action=rest-nonce and therefore does not constitute an authorization barrier. | 12 Oct |
4 of 4
Download these 4 as CSV · subscribe to this list.
EPSS scores: 2026-10-30. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.