[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107617 | 16 Oct 2026 | CVSS 9.8 | Guangzhou Juan IoT Technology Co., Ltd. EseeCloud AppAn attacker can use a hard-coded credential to log in to EseeCloud devices. | |
| CVE-2026-105664 | 16 Oct 2026 | CVSS 5.3 | Guangzhou Juan IoT Technology Co., Ltd. EseeCloud AppThe endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error… | |
| CVE-2026-63618 | 16 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache KylinExposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache… | |
| CVE-2026-63619 | 16 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache KylinMissing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact… | |
| CVE-2026-64610 | 16 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache KylinDeserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This… | |
| CVE-2026-64959 | 16 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache KylinImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in… | |
| CVE-2026-68571 | 16 Oct 2026 | CVSS 8.8 | Apache Software Foundation Apache KylinImproper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection… | |
| CVE-2026-111409 | 16 Oct 2026 | CVSS 5.3 | YITH PayPal Express Checkout for WooCommerceMissing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows… | |
| CVE-2026-111555 | 16 Oct 2026 | CVSS 6.0 | Red Hat Enterprise Linux 10A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to… | |
| CVE-2026-110896 | 16 Oct 2026 | CVSS 5.3 | WP Chill PasssterMissing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-110900 | 16 Oct 2026 | CVSS 5.3 | Liquid Web / StellarWP BookItMissing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-110901 | 16 Oct 2026 | CVSS 5.4 | WPMU DEV SmartCrawlAuthorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-110903 | 16 Oct 2026 | CVSS 6.5 | Liquid Web / StellarWP The Events CalendarImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar… | |
| CVE-2026-111396 | 16 Oct 2026 | CVSS 7.1 | Liquid Web / StellarWP Advanced Post ManagerMissing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Configured… | |
| CVE-2026-111397 | 16 Oct 2026 | CVSS 5.3 | PT Norther Lights Production MapSVGMissing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive… | |
| CVE-2026-111399 | 16 Oct 2026 | CVSS 8.5 | PT Norther Lights Production MapSVGImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG… | |
| CVE-2026-111400 | 16 Oct 2026 | CVSS 6.5 | IdeaBox Creations PowerPack Addons for ElementorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for… | |
| CVE-2026-111405 | 16 Oct 2026 | CVSS 6.5 | PT Norther Lights Production MapSVGImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG… | |
| CVE-2026-107564 | 16 Oct 2026 | CVSS 7.5 | gocsaf Development Community csaf_providerAn unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU… | |
| CVE-2026-110380 | 16 Oct 2026 | CVSS 5.3 | Arraytics WP Event SolutionMissing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-105958 | 16 Oct 2026 | CVSS 7.5 | Red Hat Enterprise Linux 6A flaw was found in spice-server. Multiple migration data handlers use client-supplied offsets from SPICE_MSGC_MIGRATE_DATA messages without bounds… | |
| CVE-2026-111390 | 16 Oct 2026 | CVSS 5.3 | erupts eruptErupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped… | |
| CVE-2026-111391 | 16 Oct 2026 | CVSS 8.1 | sgl-project sglangSGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by… | |
| CVE-2026-107648 | 16 Oct 2026 | CVSS 7.2 | switcorp WP Sessions Time Monitoring Full AutomaticThe WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function… | |
| CVE-2026-109930 | 16 Oct 2026 | CVSS 5.3 | Unknown MAIOThe MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its… | |
| CVE-2026-110029 | 16 Oct 2026 | CVSS 5.4 | Unknown SqueezeThe Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as… | |
| CVE-2026-105959 | 16 Oct 2026 | CVSS 7.5 | Red Hat Enterprise Linux 6A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback… | |
| CVE-2026-109118 | 16 Oct 2026 | CVSS 4.6 | ikus-soft rdiffwebImproper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore, history and delete operations to… | |
| CVE-2026-109119 | 16 Oct 2026 | CVSS 8.8 | ikus-soft rdiffwebImproper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows authenticated users to elevate… | |
| CVE-2026-110703 | 16 Oct 2026 | CVSS 6.4 | paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings DirectoryThe GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting… | |
| CVE-2026-14452 | 16 Oct 2026 | CVSS 8.6 | Checkmk GmbH CheckmkImproper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL) allows an… | |
| CVE-2026-96768 | 16 Oct 2026 | CVSS 7.2 | softaculous GoSMTP ProThe GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and… | |
| CVE-2026-107649 | 16 Oct 2026 | CVSS 5.4 | liedekef Events Made EasyThe Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up… | |
| CVE-2026-106030 | 16 Oct 2026 | CVSS 6.8 | Nord Security NordVPNNordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The… | |
| CVE-2026-93681 | 16 Oct 2026 | CVSS 6.4 | themeum Tutor LMS – eLearning and online course solutionThe Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in… | |
| CVE-2026-109224 | 16 Oct 2026 | CVSS 7.2 | SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & PaymentsThe SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is… | |
| CVE-2026-111311 | 16 Oct 2026 | CVSS 8.8 | samuelgallegos DoubleScale CRM | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & MoreThe DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is… | |
| CVE-2026-111472 | 16 Oct 2026 | CVSS 9.3 | TSG ProfleetAn SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete… | |
| CVE-2026-14177 | 16 Oct 2026 | CVSS 7.5 | IKAS Technology Inc. ikas E-Commerce InfrastructureObservable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects… | |
| CVE-2026-15219 | 16 Oct 2026 | CVSS 6.5 | SFM Software Technologies Inc. CostifierAuthorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted… | |
| CVE-2026-15575 | 16 Oct 2026 | CVSS 5.3 | SFM Software Technologies Inc. CostifierActive debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier… | |
| CVE-2026-92766 | 16 Oct 2026 | CVSS 7.5 | appsbd Vitepos – Point of Sale (POS) for WooCommerceThe Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all… | |
| CVE-2026-101300 | 16 Oct 2026 | CVSS 7.1 | Wegow Technologies WegowServer-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authenticated… | |
| CVE-2026-104003 | 16 Oct 2026 | CVSS 5.4 | properfraction Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePressThe WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This… | |
| CVE-2026-104726 | 16 Oct 2026 | CVSS 6.4 | jeroenpeters1986 Name DirectoryThe Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and… | |
| CVE-2026-18799 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system… | |
| CVE-2026-19076 | 16 Oct 2026 | CVSS 4.4 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account… | |
| CVE-2026-19600 | 16 Oct 2026 | CVSS 4.5 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing… | |
| CVE-2026-19621 | 16 Oct 2026 | CVSS 6.5 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post… | |
| CVE-2026-75903 | 16 Oct 2026 | CVSS 8.1 | manuelgalan Vulnity SecurityThe Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to… | |
| CVE-2026-87111 | 16 Oct 2026 | CVSS 7.2 | WPEverest User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress PluginThe User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored… | |
| CVE-2026-96870 | 16 Oct 2026 | CVSS 6.4 | brainstormforce SureDash – Community, Courses & Member DashboardThe SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name'… | |
| CVE-2026-100108 | 16 Oct 2026 | CVSS 6.4 | maxfoundry Social Share ButtonsThe Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all… | |
| CVE-2026-16251 | 16 Oct 2026 | CVSS 6.5 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses… | |
| CVE-2026-16453 | 16 Oct 2026 | CVSS 7.1 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST… | |
| CVE-2026-18223 | 16 Oct 2026 | CVSS 5.0 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address… | |
| CVE-2026-18256 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team… | |
| CVE-2026-18560 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other… | |
| CVE-2026-100106 | 16 Oct 2026 | CVSS 6.4 | damian-gora FiboSearch – Ajax Search for WooCommerceThe FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in… | |
| CVE-2026-92427 | 16 Oct 2026 | CVSS 5.3 | Unknown Coinsnap Bitcoin CrowdfundingThe Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway… | |
| CVE-2026-92553 | 16 Oct 2026 | CVSS 8.8 | yaycommerce YaySMTP – WP Mail SMTP with Email Logs, Tracking & ReportsThe YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and… | |
| CVE-2026-94169 | 16 Oct 2026 | CVSS 10.0 | Theme-one The GridImproper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects… | |
| CVE-2026-94388 | 16 Oct 2026 | CVSS 9.3 | halfdata Green PopupsImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups… | |
| CVE-2026-96339 | 16 Oct 2026 | CVSS 7.1 | Houzez.co HouzezImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected… | |
| CVE-2026-97296 | 16 Oct 2026 | CVSS 8.1 | Rocketgenius, Inc Gravity FormsDeserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity… | |
| CVE-2026-97640 | 16 Oct 2026 | CVSS 7.2 | smub WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable… | |
| CVE-2026-19798 | 16 Oct 2026 | CVSS 4.3 | tusharimran WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & FiltersThe Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and… | |
| CVE-2026-19867 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored… | |
| CVE-2026-74923 | 16 Oct 2026 | CVSS 5.3 | Unknown Document GalleryThe Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing… | |
| CVE-2026-91830 | 16 Oct 2026 | CVSS 6.5 | Unknown Subscribe to CommentsThe Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing… | |
| CVE-2026-91833 | 16 Oct 2026 | CVSS 6.8 | Unknown WX Subscribe 微信支付付费订阅The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing… | |
| CVE-2026-92115 | 16 Oct 2026 | CVSS 8.8 | opajaap WP Photo Album PlusThe WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via… | |
| CVE-2026-15222 | 16 Oct 2026 | CVSS 5.4 | wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login BuilderThe The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login… | |
| CVE-2026-18551 | 16 Oct 2026 | CVSS 6.5 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin… | |
| CVE-2026-18795 | 16 Oct 2026 | CVSS 6.4 | MattermostMattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows… | |
| CVE-2026-19541 | 16 Oct 2026 | CVSS 6.5 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret… | |
| CVE-2026-19601 | 16 Oct 2026 | CVSS 4.9 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password… | |
| CVE-2026-19603 | 16 Oct 2026 | CVSS 4.3 | MattermostMattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by… | |
| CVE-2026-110252 | 16 Oct 2026 | CVSS 5.4 | etruel WPeMatico RSS Feed FetcherThe WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to… | |
| CVE-2026-110290 | 16 Oct 2026 | CVSS 6.4 | ajay WebberZone Top 10 — Popular PostsThe WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject… | |
| CVE-2026-110366 | 16 Oct 2026 | CVSS 5.3 | Gemini Labs Site ReviewsMissing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-110664 | 16 Oct 2026 | CVSS 6.4 | codename065 Premium Packages – Sell Digital Products SecurelyThe Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in… | |
| CVE-2026-110701 | 16 Oct 2026 | CVSS 7.2 | codepeople CP Multi View Events CalendarThe CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions… | |
| CVE-2026-111069 | 16 Oct 2026 | CVSS 6.4 | paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings DirectoryThe GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting… | |
| CVE-2026-111178 | 16 Oct 2026 | CVSS 4.9 | murgroland WP Booking System – Booking CalendarThe WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'data[orderby]' parameter in all… | |
| CVE-2026-109982 | 16 Oct 2026 | CVSS 4.2 | Unknown MB Custom Post Types & Custom TaxonomiesThe MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 does not perform a capability check or validate a nonce on its migration… | |
| CVE-2026-110012 | 16 Oct 2026 | CVSS 4.3 | Unknown Salon Booking SystemThe Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate… | |
| CVE-2026-110013 | 16 Oct 2026 | CVSS 4.8 | Unknown Salon Booking SystemThe Salon Booking System WordPress plugin before 10.31.9 does not generate its booking-API access tokens from a secure random source, instead… | |
| CVE-2026-110014 | 16 Oct 2026 | CVSS 5.3 | Unknown Salon Booking SystemThe Salon Booking System WordPress plugin before 10.31.9 does not properly check authorization before creating a booking and trusts a caller-supplied… | |
| CVE-2026-110015 | 16 Oct 2026 | CVSS 8.8 | Unknown Salon Booking SystemThe Salon Booking System WordPress plugin before 10.31.9 does not correctly verify the authenticity of REST API requests and discards WordPress… | |
| CVE-2026-110039 | 16 Oct 2026 | CVSS 2.7 | Unknown SmushThe Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an… | |
| CVE-2026-110135 | 16 Oct 2026 | CVSS 7.4 | Unknown OTP Login & Register WoocommerceThe OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the… | |
| CVE-2026-110179 | 16 Oct 2026 | CVSS 6.8 | Unknown affiliate-toolkitThe affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database… | |
| CVE-2026-110191 | 16 Oct 2026 | CVSS 2.7 | Unknown Product Delivery Date for WooCommerceThe Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through… | |
| CVE-2026-107768 | 16 Oct 2026 | CVSS 7.2 | cozmoslabs TranslatePress – Translate Multilingual sites with AI TranslationThe TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-107770 | 16 Oct 2026 | CVSS 6.8 | tigroumeow Photo Engine (Media Organizer & Lightroom)The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6… | |
| CVE-2026-109193 | 16 Oct 2026 | CVSS 7.2 | HivePress – Business Directory, Listings & Classified Ads PluginThe HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-109382 | 16 Oct 2026 | CVSS 6.5 | bilalnaseer WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI AgentsThe WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This… | |
| CVE-2026-109388 | 16 Oct 2026 | CVSS 6.4 | HivePress – Business Directory, Listings & Classified Ads PluginThe HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-109401 | 16 Oct 2026 | CVSS 2.7 | smub WP Mail LoggingThe WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the… |
Page 44 of 168