[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-97261 | 30 Sep 2026 | CVSS 5.3 | VillaTheme NotivoUnauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. | |
| CVE-2026-97262 | 30 Sep 2026 | CVSS 6.5 | Visual Composer Website BuilderContributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. | |
| CVE-2026-97266 | 30 Sep 2026 | CVSS 6.5 | Nexcess Virtue/Ascend/Pinnacle ToolkitContributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. | |
| CVE-2026-97267 | 30 Sep 2026 | CVSS 4.3 | miniOrange Prevent files / folders accessSubscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions. | |
| CVE-2026-97270 | 30 Sep 2026 | CVSS 6.5 | Justin Sternberg CMB2Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. | |
| CVE-2026-97242 | 30 Sep 2026 | CVSS 6.8 | phuongwebo WEBO MCPAuthor Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions. | |
| CVE-2026-97243 | 30 Sep 2026 | CVSS 5.4 | flexyma AllAble ConnectorSubscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. | |
| CVE-2026-97244 | 30 Sep 2026 | CVSS 7.5 | WPFunnels Creator LMSContributor Path Traversal in Creator LMS <= 1.2.19 versions. | |
| CVE-2026-97245 | 30 Sep 2026 | CVSS 7.2 | SureCartShop Worker Privilege Escalation in SureCart <= 4.7.2 versions. | |
| CVE-2026-97246 | 30 Sep 2026 | CVSS 4.9 | ShortPixel Image OptimizerDeserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This… | |
| CVE-2026-97247 | 30 Sep 2026 | CVSS 6.5 | Creative Themes Blocksy CompanionUnauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. | |
| CVE-2026-97248 | 30 Sep 2026 | CVSS 9.8 | Booking Activities Team Booking ActivitiesUnauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. | |
| CVE-2026-97249 | 30 Sep 2026 | CVSS 5.3 | Cozmoslabs Paid Member SubscriptionsUnauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions. | |
| CVE-2026-97235 | 30 Sep 2026 | CVSS 7.1 | ThemeREX AddonsUnauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | |
| CVE-2026-97236 | 30 Sep 2026 | CVSS 6.5 | ThemeREX AddonsSubscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | |
| CVE-2026-97237 | 30 Sep 2026 | CVSS 7.1 | Crocoblock JetEngineImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows… | |
| CVE-2026-97238 | 30 Sep 2026 | CVSS 5.5 | Crocoblock. Jetimpex Inc. JetEngineSubscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. | |
| CVE-2026-97239 | 30 Sep 2026 | CVSS 6.5 | Jose Conti MCP Content Manager LiteSubscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. | |
| CVE-2026-97240 | 30 Sep 2026 | CVSS 7.5 | Esteban StifLi Backup ToolsUnauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. | |
| CVE-2026-97241 | 30 Sep 2026 | CVSS 7.5 | PrecisionWP BackupEaseUnauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. | |
| CVE-2026-97066 | 30 Sep 2026 | CVSS 5.3 | Nexcess GiveWPUnauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions. | |
| CVE-2026-97067 | 30 Sep 2026 | CVSS 6.5 | Shane Bishop EWWW Image OptimizerContributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions. | |
| CVE-2026-97074 | 30 Sep 2026 | CVSS 4.3 | Omnisend Newsletters, Email Marketing, SMS and Popups by OmnisendSubscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions. | |
| CVE-2026-97077 | 30 Sep 2026 | CVSS 7.1 | Spacetime Ad InserterUnauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. | |
| CVE-2026-97078 | 30 Sep 2026 | CVSS 5.3 | BoldGrid Client Invoicing by Sprout InvoicesUnauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions. | |
| CVE-2026-97079 | 30 Sep 2026 | CVSS 4.3 | Webba Appointment Booking Webba BookingSubscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions. | |
| CVE-2026-97197 | 30 Sep 2026 | CVSS 7.5 | WebToffee WordPress Backup & MigrationUnauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions. | |
| CVE-2026-96832 | 30 Sep 2026 | CVSS 7.2 | keywordrush Content EggShop manager PHP Object Injection in Content Egg <= 6.3.1 versions. | |
| CVE-2026-96833 | 30 Sep 2026 | CVSS 7.2 | Themefic Ultimate Addons for Contact Form 7Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions. | |
| CVE-2026-96834 | 30 Sep 2026 | CVSS 6.5 | Nexcess GiveWPSubscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions. | |
| CVE-2026-96835 | 30 Sep 2026 | CVSS 6.5 | KingAddons.com King Addons for ElementorContributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions. | |
| CVE-2026-96836 | 30 Sep 2026 | CVSS 7.1 | Morteza Geransayeh Parsi DateUnauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions. | |
| CVE-2026-96837 | 30 Sep 2026 | CVSS 8.8 | Brainstorm Force CartFlowsContributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions. | |
| CVE-2026-96838 | 30 Sep 2026 | CVSS 8.8 | YoOhw Studio Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout VerificationUnauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1… | |
| CVE-2026-97065 | 30 Sep 2026 | CVSS 7.1 | HappyformsUnauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. | |
| CVE-2026-96824 | 30 Sep 2026 | CVSS 6.8 | envato Template Kit – ImportEditor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions. | |
| CVE-2026-96825 | 30 Sep 2026 | CVSS 4.2 | David Anderson / Team Updraft All In One WP Security & FirewallSubscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions. | |
| CVE-2026-96827 | 30 Sep 2026 | CVSS 7.6 | Melapress Admin Notices ManagerAdministrator SQL Injection in Admin Notices Manager <= 1.6.0 versions. | |
| CVE-2026-96828 | 30 Sep 2026 | CVSS 7.6 | Vidish Category Discount WoocommerceAdministrator SQL Injection in Category Discount Woocommerce <= 5.18 versions. | |
| CVE-2026-96829 | 30 Sep 2026 | CVSS 6.5 | POSIMYTH The Plus Addons for Elementor Page Builder LiteContributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions. | |
| CVE-2026-96830 | 30 Sep 2026 | CVSS 7.1 | Nexcess GiveWPUnauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions. | |
| CVE-2026-96831 | 30 Sep 2026 | CVSS 8.8 | themifyme Themify BuilderContributor PHP Object Injection in Themify Builder <= 7.8.1 versions. | |
| CVE-2026-96817 | 30 Sep 2026 | CVSS 8.2 | MakeCommerce.net MakeCommerce for WooCommerceSubscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions. | |
| CVE-2026-96818 | 30 Sep 2026 | CVSS 7.5 | mra13 / Team Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments)Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions. | |
| CVE-2026-96819 | 30 Sep 2026 | CVSS 7.1 | bobbingwide oikSubscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions. | |
| CVE-2026-96820 | 30 Sep 2026 | CVSS 7.1 | awesomesupport Awesome SupportSubscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions. | |
| CVE-2026-96821 | 30 Sep 2026 | CVSS 6.3 | Mahmudul Hasan Arif FluentBoardsSubscriber Privilege Escalation in FluentBoards <= 2.0.12 versions. | |
| CVE-2026-96822 | 30 Sep 2026 | CVSS 9.3 | Hossni Mubarak Books GalleryUnauthenticated SQL Injection in Books Gallery <= 4.8.3 versions. | |
| CVE-2026-96823 | 30 Sep 2026 | CVSS 7.5 | CusRev Customer Reviews for WooCommerceUnauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions. | |
| CVE-2026-96350 | 30 Sep 2026 | CVSS 9.8 | EstatikSubscriber Privilege Escalation in Estatik <= 4.3.5 versions. | |
| CVE-2026-96351 | 30 Sep 2026 | CVSS 7.1 | RadiusTheme Classified ListingUnauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions. | |
| CVE-2026-96352 | 30 Sep 2026 | CVSS 7.1 | YITHEMES YITH WooCommerce Ajax SearchUnauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions. | |
| CVE-2026-96450 | 30 Sep 2026 | CVSS 5.4 | pixfort CoreContributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions. | |
| CVE-2026-96814 | 30 Sep 2026 | CVSS 7.1 | WP Titan Labs WooCommerce Product Table LiteUnauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions. | |
| CVE-2026-96815 | 30 Sep 2026 | CVSS 7.2 | appsbd ViteposCustom role Privilege Escalation in Vitepos <= 3.5.0 versions. | |
| CVE-2026-96816 | 30 Sep 2026 | CVSS 7.1 | vendidero Trusted Shops Easy Integration for WooCommerceUnauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions. | |
| CVE-2026-96338 | 30 Sep 2026 | CVSS 6.5 | Cozmoslabs Profile BuilderSubscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions. | |
| CVE-2026-96343 | 30 Sep 2026 | CVSS 7.2 | weDevs WP ERPCustom role PHP Object Injection in WP ERP <= 1.17.9 versions. | |
| CVE-2026-96344 | 30 Sep 2026 | CVSS 7.2 | impleCode eCommerce Product CatalogCustom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions. | |
| CVE-2026-96345 | 30 Sep 2026 | CVSS 7.6 | EstatikAdministrator SQL Injection in Estatik <= 4.3.5 versions. | |
| CVE-2026-96346 | 30 Sep 2026 | CVSS 7.6 | weDevs WP ERPAuthor SQL Injection in WP ERP <= 1.17.9 versions. | |
| CVE-2026-96347 | 30 Sep 2026 | CVSS 6.5 | BooklySubscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions. | |
| CVE-2026-96348 | 30 Sep 2026 | CVSS 7.5 | BooklyUnauthenticated Broken Access Control in Bookly <= 28.2 versions. | |
| CVE-2026-96349 | 30 Sep 2026 | CVSS 10.0 | SiteSkiteUnauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions. | |
| CVE-2026-95531 | 30 Sep 2026 | CVSS 8.8 | QuantumCloud Conversational Forms for ChatBotSubscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions. | |
| CVE-2026-95587 | 30 Sep 2026 | CVSS 7.5 | Hostinger MigratorUnauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions. | |
| CVE-2026-95616 | 30 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache WSS4JAn integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message… | |
| CVE-2026-94499 | 30 Sep 2026 | CVSS 7.1 | wpWax FormGentSubscriber Broken Access Control in FormGent <= 1.12.2 versions. | |
| CVE-2026-94672 | 30 Sep 2026 | CVSS 4.3 | 10up Safe SVGContributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions. | |
| CVE-2026-94673 | 30 Sep 2026 | CVSS 5.3 | NSquared Simply Schedule AppointmentsUnauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions. | |
| CVE-2026-94674 | 30 Sep 2026 | CVSS 6.5 | SweetCode Pixel Manager for WooCommerceContributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions. | |
| CVE-2026-94677 | 30 Sep 2026 | CVSS 7.2 | Nexcess Kadence WooCommerce Email DesignerShop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions. | |
| CVE-2026-94678 | 30 Sep 2026 | CVSS 8.8 | Mat Lipe Go Live Update UrlsContributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions. | |
| CVE-2026-94681 | 30 Sep 2026 | CVSS 5.9 | Tijmen Smit WP Store LocatorUnauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions. | |
| CVE-2026-94683 | 30 Sep 2026 | CVSS 8.8 | Justin Nealey DesignSetGoContributor PHP Object Injection in DesignSetGo <= 2.8.0 versions. | |
| CVE-2026-94389 | 30 Sep 2026 | CVSS 9.0 | AcyMailing Newsletter Team AcyMailing SMTP NewsletterUnauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions. | |
| CVE-2026-94123 | 30 Sep 2026 | CVSS 7.5 | Syed Balkhi NextGEN GalleryUnauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions. | |
| CVE-2026-94173 | 30 Sep 2026 | CVSS 5.4 | Strategy11 Team Business DirectoryContributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions. | |
| CVE-2026-94177 | 30 Sep 2026 | CVSS 8.5 | Ruben Garcia GamiPressImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind… | |
| CVE-2026-94178 | 30 Sep 2026 | CVSS 7.5 | Javier Carazo Import and export users and customersSubscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions. | |
| CVE-2026-94082 | 30 Sep 2026 | CVSS 7.6 | Fatcatapps Quiz CatAuthor SQL Injection in Quiz Cat <= 3.1.1 versions. | |
| CVE-2026-94115 | 30 Sep 2026 | CVSS 8.5 | Fatcatapps Easy Pricing TablesContributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions. | |
| CVE-2026-94120 | 30 Sep 2026 | CVSS 7.5 | GravityKit GravityExport Lite for Gravity FormsUnauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions. | |
| CVE-2026-94121 | 30 Sep 2026 | CVSS 8.8 | 10Web Booster – Website speed optimization, Cache & Page Speed optimizerContributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions. | |
| CVE-2026-94122 | 30 Sep 2026 | CVSS 7.2 | A WP Life Responsive Slider GalleryEditor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions. | |
| CVE-2026-94076 | 30 Sep 2026 | CVSS 8.8 | SEO Squirrly SEO Plugin by Squirrly SEOContributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions. | |
| CVE-2026-94077 | 30 Sep 2026 | CVSS 6.5 | 10up Safe SVGContributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions. | |
| CVE-2026-94078 | 30 Sep 2026 | CVSS 7.1 | Gemini Labs Site ReviewsUnauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions. | |
| CVE-2026-94081 | 30 Sep 2026 | CVSS 7.1 | lukeseager WordPress Persistent LoginUnauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions. | |
| CVE-2026-93514 | 30 Sep 2026 | CVSS 7.1 | rainafarai Notification for TelegramUnauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions. | |
| CVE-2026-93621 | 30 Sep 2026 | CVSS 8.2 | Passionate Programmer Peter WP Data AccessUnauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. | |
| CVE-2026-93624 | 30 Sep 2026 | CVSS 7.2 | codepeople Music Player for WooCommerceShop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions. | |
| CVE-2026-93651 | 30 Sep 2026 | CVSS 7.2 | Dotstore Minimum and Maximum Quantity for WooCommerceAuthor PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions. | |
| CVE-2026-93770 | 30 Sep 2026 | CVSS 7.1 | VeronaLabs WP StatisticsUnauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions. | |
| CVE-2026-93771 | 30 Sep 2026 | CVSS 7.2 | WPFactory Cost of Goods for WooCommerceShop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions. | |
| CVE-2026-94074 | 30 Sep 2026 | CVSS 6.5 | NSquared Simply Schedule AppointmentsUnauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions. | |
| CVE-2026-86778 | 30 Sep 2026 | CVSS 5.3 | Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft GymObservable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account… | |
| CVE-2026-89238 | 30 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache WSS4JWSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect… | |
| CVE-2026-92121 | 30 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache WSS4JIn the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag… | |
| CVE-2026-92899 | 30 Sep 2026 | CVSS 4.8 | Apache Software Foundation Apache WSS4JApache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but… |
Page 135 of 168