[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105149 | 4 Oct 2026 | CVSS 7.3 | mooSocialA security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. Performing… | |
| CVE-2026-105147 | 4 Oct 2026 | CVSS 7.3 | SciPhi-AI R2RA vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of… | |
| CVE-2026-97307 | 4 Oct 2026 | CVSS 7.5 | StylemixThemes Cost Calculator BuilderInsertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve… | |
| CVE-2026-105146 | 4 Oct 2026 | CVSS 4.7 | Comsenz Discuz!A vulnerability was found in Comsenz Discuz! X5.0-20260801/X5.0-20260820/X5.0-20260910. Affected by this issue is the function modmedalsubmit of the… | |
| CVE-2026-105145 | 4 Oct 2026 | CVSS 5.3 | Weaviate VerbaA vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file… | |
| CVE-2026-105141 | 4 Oct 2026 | CVSS 6.3 | topoteretes cogneeA security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file… | |
| CVE-2026-105144 | 4 Oct 2026 | CVSS 5.3 | DrogonA flaw has been found in Drogon up to 1.9.13-1/10.0-beta.3 on Windows. Affected is the function StaticFileRouter::route of the file… | |
| CVE-2026-97276 | 4 Oct 2026 | CVSS 7.1 | VeronaLabs WP StatisticsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows… | |
| CVE-2026-103344 | 4 Oct 2026 | CVSS 7.1 | Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For… | |
| CVE-2026-103354 | 4 Oct 2026 | CVSS 7.1 | Liquid Web / StellarWP Gutenberg Blocks by Kadence BlocksImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by… | |
| CVE-2026-103355 | 4 Oct 2026 | CVSS 9.3 | Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For… | |
| CVE-2026-105137 | 4 Oct 2026 | CVSS 5.0 | LaradockA vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process… | |
| CVE-2026-103062 | 4 Oct 2026 | CVSS 7.1 | Cozmoslabs TranslatePressImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress… | |
| CVE-2026-86817 | 4 Oct 2026 | CVSS 4.9 | Unknown Five Star Business Profile and SchemaThe Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default… | |
| CVE-2026-93549 | 4 Oct 2026 | CVSS 8.8 | Unknown CoCartThe CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST… | |
| CVE-2026-97332 | 4 Oct 2026 | CVSS 5.3 | Unknown User Private FilesThe User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite… | |
| CVE-2026-105133 | 4 Oct 2026 | CVSS 7.3 | Ahsay AhsayCBS Improper AuthenticationA vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. This affects the function checkSysPwd of the file… | Exploited |
| CVE-2026-105134 | 4 Oct 2026 | CVSS 10.0 | Command injection in AhsayCBS backup serverA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the… | Exploited |
| CVE-2026-105135 | 4 Oct 2026 | CVSS 10.0 | InternLM MindSearchA vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file… | |
| CVE-2026-17005 | 4 Oct 2026 | CVSS 6.8 | Unknown Horizontal scrolling announcementsThe Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting… | |
| CVE-2026-104119 | 4 Oct 2026 | CVSS 3.5 | Unknown Simple Shopping CartThe Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings… | |
| CVE-2026-104118 | 4 Oct 2026 | CVSS 5.3 | Unknown Razorpay for WooCommerceThe Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during… | |
| CVE-2026-105099 | 4 Oct 2026 | CVSS 3.5 | Omega Solution CoinEx CryptoA weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file… | |
| CVE-2026-88779 | 4 Oct 2026 | CVSS 7.5 | Exploited denial of service flaw in NetScaler ADC and GatewayVulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and… | ExploitedFix |
| CVE-2026-105098 | 4 Oct 2026 | CVSS 4.3 | Omega Solution CoinEx CryptoA security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the… | |
| CVE-2026-105097 | 4 Oct 2026 | CVSS 4.3 | Omega Solution CoinEx CryptoA vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the… | |
| CVE-2026-105131 | 4 Oct 2026 | CVSS 5.4 | mayswind ezBookkeepingezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full session… | |
| CVE-2026-105096 | 4 Oct 2026 | CVSS 6.3 | Omega Solution CoinEx CryptoA vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component… | |
| CVE-2026-105126 | 4 Oct 2026 | CVSS 7.2 | laradashboardLaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by… | |
| CVE-2026-105127 | 4 Oct 2026 | CVSS 5.3 | laradashboardLaraDashboard 1.4.2 before 1.4.8 applies advanced email validation to unauthenticated forgot-password and reset-password requests, triggering DNS… | |
| CVE-2026-105128 | 4 Oct 2026 | CVSS 5.4 | laradashboardLaraDashboard before 1.4.8 contains an open redirect vulnerability that allows remote attackers to redirect users by supplying an unvalidated… | |
| CVE-2026-105129 | 4 Oct 2026 | CVSS 6.5 | laradashboardLaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to… | |
| CVE-2026-105130 | 4 Oct 2026 | CVSS 3.7 | laradashboardLaraDashboard from 1.4.0 before 1.4.8 contains a race condition vulnerability in RegisterController::register that allows unauthenticated attackers… | |
| CVE-2026-105123 | 4 Oct 2026 | CVSS 8.8 | vincent-peugnet wcmsW (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by… | |
| CVE-2026-105124 | 4 Oct 2026 | CVSS 6.1 | vincent-peugnet wcmsW (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts… | |
| CVE-2026-105125 | 4 Oct 2026 | CVSS 3.7 | laradashboardLaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the… | |
| CVE-2026-96451 | 3 Oct 2026 | CVSS 8.8 | Ultimate MemberAuthorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This… | |
| CVE-2026-103342 | 3 Oct 2026 | CVSS 7.1 | Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For… | |
| CVE-2026-103065 | 3 Oct 2026 | CVSS 8.2 | Themeum KirkiImproper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by… | |
| CVE-2026-105122 | 3 Oct 2026 | CVSS 5.4 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients to make… | |
| CVE-2026-105115 | 3 Oct 2026 | CVSS 8.6 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote… | |
| CVE-2026-105116 | 3 Oct 2026 | CVSS 6.1 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into the… | |
| CVE-2026-105117 | 3 Oct 2026 | CVSS 6.1 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording… | |
| CVE-2026-105118 | 3 Oct 2026 | CVSS 4.7 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverified… | |
| CVE-2026-105119 | 3 Oct 2026 | CVSS 6.8 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued… | |
| CVE-2026-105120 | 3 Oct 2026 | CVSS 4.9 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to… | |
| CVE-2026-105121 | 3 Oct 2026 | CVSS 4.9 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their realms… | |
| CVE-2026-105112 | 3 Oct 2026 | CVSS 5.3 | nezhahq nezhaNezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock… | |
| CVE-2026-105113 | 3 Oct 2026 | CVSS 6.5 | nezhahq nezhaNezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path… | |
| CVE-2026-105114 | 3 Oct 2026 | CVSS 6.1 | OpenIdentityPlatform OpenAMOpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying… | |
| CVE-2026-105105 | 3 Oct 2026 | CVSS 9.8 | NASA-AMMOS AIT-CoreCWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through… | |
| CVE-2026-104983 | 3 Oct 2026 | CVSS 6.3 | Linux Mint XreaderA vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the… | |
| CVE-2026-85515 | 3 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path… | |
| CVE-2026-97873 | 3 Oct 2026 | CVSS 5.3 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key… | |
| CVE-2026-71887 | 3 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature… | |
| CVE-2026-71888 | 3 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields… | |
| CVE-2026-71889 | 3 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy… | |
| CVE-2026-71890 | 3 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list… | |
| CVE-2026-71891 | 3 Oct 2026 | CVSS 7.1 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so BLSPublicKeyParameters and every BasicScheme, MessageAugmentation and… | |
| CVE-2026-71892 | 3 Oct 2026 | CVSS 6.9 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key-transport recipients… | |
| CVE-2026-18040 | 3 Oct 2026 | CVSS 5.9 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by… | |
| CVE-2026-71883 | 3 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. BC-LTS-JAVAIn Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's… | |
| CVE-2026-71885 | 3 Oct 2026 | CVSS 9.2 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's… | |
| CVE-2026-71886 | 3 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any… | |
| CVE-2026-92767 | 3 Oct 2026 | CVSS 6.4 | zayedbaloch Twenty20 Image Before-AfterThe Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up… | |
| CVE-2026-104982 | 3 Oct 2026 | CVSS 4.3 | Linux Mint XreaderA flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file… | |
| CVE-2026-92084 | 3 Oct 2026 | CVSS 9.1 | beaverbuilder Beaver Builder Page Builder – Drag and Drop Website BuilderThe The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all… | |
| CVE-2026-94505 | 3 Oct 2026 | CVSS 8.1 | Nelio Content – Editorial Calendar & Social Media Auto-PostingThe Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to… | |
| CVE-2026-96267 | 3 Oct 2026 | CVSS 7.5 | osamaesh WP Visitor Statistics (Real Time Traffic)The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions… | |
| CVE-2026-97343 | 3 Oct 2026 | CVSS 4.3 | burstbv Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative)The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication… | |
| CVE-2026-97660 | 3 Oct 2026 | CVSS 7.2 | wpclever WPC Product Options for WooCommerceThe WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field… | |
| CVE-2026-75028 | 3 Oct 2026 | CVSS 7.5 | arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking SystemThe WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions… | |
| CVE-2026-87115 | 3 Oct 2026 | CVSS 9.1 | e4jvikwp VikAppointments Services Booking CalendarThe VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… | |
| CVE-2026-92974 | 3 Oct 2026 | CVSS 6.1 | 10web Photo Gallery by 10Web – Mobile-Friendly Image GalleryThe Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url'… | |
| CVE-2026-93889 | 3 Oct 2026 | CVSS 7.2 | wardee Mail logging & CatcherThe Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in… | |
| CVE-2026-93896 | 3 Oct 2026 | CVSS 6.1 | syammohanm WPFront Notification BarThe WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is… | |
| CVE-2026-103519 | 3 Oct 2026 | CVSS 5.4 | roxnor WP Ultimate ReviewThe The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is… | |
| CVE-2026-104313 | 3 Oct 2026 | CVSS 6.1 | wpclever WPC Estimated Delivery Date for WooCommerceThe WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter in… | |
| CVE-2026-11601 | 3 Oct 2026 | CVSS 5.3 | arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking SystemThe WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions… | |
| CVE-2026-15795 | 3 Oct 2026 | CVSS 6.4 | cyberchimps Responsive Starter Templates – Elementor Templates & Starter SitesThe Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes… | |
| CVE-2026-18443 | 3 Oct 2026 | CVSS 8.8 | storeapps Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the… | |
| CVE-2026-100157 | 3 Oct 2026 | CVSS 6.5 | roxnor WP Ultimate ReviewThe The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is… | |
| CVE-2026-103421 | 3 Oct 2026 | CVSS 5.4 | amauric WPMobile.App – Android and iOS App BuilderThe WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment… | |
| CVE-2026-97341 | 3 Oct 2026 | CVSS 7.2 | wp-buy Visitor Traffic Real Time StatisticsThe Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in… | |
| CVE-2026-97344 | 3 Oct 2026 | CVSS 6.4 | roxnor Wp Social Login and Register Social CounterThe Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via… | |
| CVE-2026-96650 | 3 Oct 2026 | CVSS 7.2 | wpchill Strong TestimonialsThe Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up… | |
| CVE-2026-96962 | 3 Oct 2026 | CVSS 3.7 | Unknown Pie RegisterThe Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a… | |
| CVE-2026-97337 | 3 Oct 2026 | CVSS 7.5 | wpinsider-1 Simple MembershipThe Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to… | |
| CVE-2026-94238 | 3 Oct 2026 | CVSS 6.8 | Unknown Loco TranslateThe Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the… | |
| CVE-2026-94239 | 3 Oct 2026 | CVSS 6.8 | Unknown Loco TranslateThe Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an… | |
| CVE-2026-96564 | 3 Oct 2026 | CVSS 7.2 | rainbowgeek SEOPress – AI SEO Plugin & On-site SEOThe SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions… | |
| CVE-2026-96575 | 3 Oct 2026 | CVSS 7.2 | ivijanstefan Transliterator – Multilingual and Multi-script Text ConversionThe Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment… | |
| CVE-2026-92437 | 3 Oct 2026 | CVSS 5.3 | Unknown Mailchimp for WooCommerceThe Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a… | |
| CVE-2026-92923 | 3 Oct 2026 | CVSS 6.3 | Unknown Unlimited Elements for ElementorThe Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement… | |
| CVE-2026-93430 | 3 Oct 2026 | CVSS 7.2 | gdragon GD Rating SystemThe GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX… | |
| CVE-2026-88783 | 3 Oct 2026 | CVSS 8.8 | Unknown Kubio AI Page BuilderThe Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider… | |
| CVE-2026-89236 | 3 Oct 2026 | CVSS 8.6 | Unknown SaveTo Wishlist LiteThe SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL… | |
| CVE-2026-91078 | 3 Oct 2026 | CVSS 8.2 | Unknown TillKitThe TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation… | |
| CVE-2026-91108 | 3 Oct 2026 | CVSS 4.3 | alttextai Alt Text AI – Automatically generate image alt text for SEO and accessibilityThe Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all… | |
| CVE-2026-86834 | 3 Oct 2026 | CVSS 3.7 | Unknown MetFormThe MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when… |
Page 122 of 168