[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-62082 | 10 Oct 2026 | CVSS 7.1 | An-Themes Pin WPUnauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions. | |
| CVE-2026-62086 | 10 Oct 2026 | CVSS 9.8 | ThemeREX JunoUnauthenticated PHP Object Injection in Juno <= 2.25 versions. | |
| CVE-2026-62087 | 10 Oct 2026 | CVSS 9.8 | ThemeREX EquadioUnauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. | |
| CVE-2026-62090 | 10 Oct 2026 | CVSS 9.8 | ThemeREX WineShopUnauthenticated PHP Object Injection in WineShop <= 3.20 versions. | |
| CVE-2026-62091 | 10 Oct 2026 | CVSS 7.1 | kutethemes ArmaniaUnauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions. | |
| CVE-2026-62092 | 10 Oct 2026 | CVSS 8.1 | kutethemes ArmaniaUnauthenticated Local File Inclusion in Armania <= 1.4.8 versions. | |
| CVE-2026-62093 | 10 Oct 2026 | CVSS 7.1 | kutethemes TechOneUnauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions. | |
| CVE-2026-62065 | 10 Oct 2026 | CVSS 8.1 | CocoBasic CardeaUnauthenticated Local File Inclusion in Cardea <= 2.3 versions. | |
| CVE-2026-62066 | 10 Oct 2026 | CVSS 8.1 | CocoBasic VolosUnauthenticated Local File Inclusion in Volos <= 1.2 versions. | |
| CVE-2026-62067 | 10 Oct 2026 | CVSS 8.1 | CocoBasic KavenUnauthenticated Local File Inclusion in Kaven <= 1.2 versions. | |
| CVE-2026-62068 | 10 Oct 2026 | CVSS 8.1 | CocoBasic TeoroUnauthenticated Local File Inclusion in Teoro <= 1.1 versions. | |
| CVE-2026-62069 | 10 Oct 2026 | CVSS 8.1 | CocoBasic FabiusUnauthenticated Local File Inclusion in Fabius <= 1.0 versions. | |
| CVE-2026-62070 | 10 Oct 2026 | CVSS 8.1 | CKThemes FlipmartUnauthenticated Local File Inclusion in Flipmart <= 2.8 versions. | |
| CVE-2026-62074 | 10 Oct 2026 | CVSS 8.1 | ThemeREX OzeumUnauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. | |
| CVE-2026-62075 | 10 Oct 2026 | CVSS 8.1 | Mymoun BackhoeUnauthenticated Local File Inclusion in Backhoe <= 2.0 versions. | |
| CVE-2026-62038 | 10 Oct 2026 | CVSS 7.3 | DigitalME eRoomUnauthenticated Broken Authentication in eRoom <= 1.7.1 versions. | |
| CVE-2026-62043 | 10 Oct 2026 | CVSS 7.5 | sevenspark Contact Form 7 – Dynamic Text ExtensionUnauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions. | |
| CVE-2026-62050 | 10 Oct 2026 | CVSS 9.8 | ThemeREX SplendourUnauthenticated PHP Object Injection in Splendour <= 1.23 versions. | |
| CVE-2026-62051 | 10 Oct 2026 | CVSS 9.8 | ThemeREX StargazeUnauthenticated PHP Object Injection in Stargaze <= 1.10 versions. | |
| CVE-2026-62052 | 10 Oct 2026 | CVSS 9.8 | ThemeREX TipsyUnauthenticated PHP Object Injection in Tipsy <= 1.6 versions. | |
| CVE-2026-62053 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Wine HouseUnauthenticated PHP Object Injection in Wine House <= 3.20 versions. | |
| CVE-2026-62054 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Yacht RentalUnauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. | |
| CVE-2026-62064 | 10 Oct 2026 | CVSS 7.1 | Bracketweb AmbedUnauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions. | |
| CVE-2026-62030 | 10 Oct 2026 | CVSS 7.2 | bPlugins StreamCastUnauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions. | |
| CVE-2026-62031 | 10 Oct 2026 | CVSS 9.3 | Stylemix uListingUnauthenticated SQL Injection in uListing <= 2.2.0 versions. | |
| CVE-2026-62032 | 10 Oct 2026 | CVSS 9.8 | Designinvento DirectoryPressUnauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. | |
| CVE-2026-62033 | 10 Oct 2026 | CVSS 7.6 | Stylemix uListingSubscriber Settings Change in uListing <= 2.2.0 versions. | |
| CVE-2026-62034 | 10 Oct 2026 | CVSS 7.1 | bPlugins Before After Image Comparison – Image comparison for WPUnauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions. | |
| CVE-2026-62035 | 10 Oct 2026 | CVSS 6.3 | upcasted AWS S3 for WordPress Plugin – UpcastedSubscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions. | |
| CVE-2026-62037 | 10 Oct 2026 | CVSS 7.1 | bPlugins Document EmbedderUnauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions. | |
| CVE-2026-48194 | 10 Oct 2026 | CVSS 8.1 | kutethemes DukaMarketUnauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. | |
| CVE-2026-57742 | 10 Oct 2026 | CVSS 7.1 | ThemeREX Group Kids PlanetImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected… | |
| CVE-2026-62020 | 10 Oct 2026 | CVSS 8.1 | Mikado-Themes TouchUpUnauthenticated Local File Inclusion in TouchUp < 1.4 versions. | |
| CVE-2026-62021 | 10 Oct 2026 | CVSS 8.8 | rascals AngioSubscriber PHP Object Injection in Angio <= 1.1.1 versions. | |
| CVE-2026-62022 | 10 Oct 2026 | CVSS 9.8 | Select-Themes Tonda MembershipUnauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions. | |
| CVE-2026-62024 | 10 Oct 2026 | CVSS 9.9 | CodeBard Help DeskSubscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions. | |
| CVE-2026-62025 | 10 Oct 2026 | CVSS 9.0 | Tailored Media Tailored ToolsUnauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions. | |
| CVE-2026-62027 | 10 Oct 2026 | CVSS 7.1 | bPlugins Team Section BlockUnauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions. | |
| CVE-2026-42719 | 10 Oct 2026 | CVSS 9.8 | Sarah Giles Dynamic User DirectorySubscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions. | |
| CVE-2026-42722 | 10 Oct 2026 | CVSS 7.6 | Shabti Kaplan Frontend Admin by DynamiAppsAdministrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. | |
| CVE-2026-42723 | 10 Oct 2026 | CVSS 9.8 | AncoraThemes CleanSkinUnauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. | |
| CVE-2026-42724 | 10 Oct 2026 | CVSS 8.1 | AncoraThemes CleanSkinUnauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. | |
| CVE-2026-42777 | 10 Oct 2026 | CVSS 8.1 | Edge-Themes AaltoUnauthenticated Local File Inclusion in Aalto <= 1.8 versions. | |
| CVE-2026-45440 | 10 Oct 2026 | CVSS 7.6 | Smackcoders Inc. WP Ultimate CSV ImporterAdministrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. | |
| CVE-2026-48193 | 10 Oct 2026 | CVSS 8.1 | kutethemes UminexUnauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. | |
| CVE-2026-42706 | 10 Oct 2026 | CVSS 7.5 | ThemeGoods DKUnauthenticated Broken Access Control in DK <= 3.2.1 versions. | |
| CVE-2026-42709 | 10 Oct 2026 | CVSS 7.1 | RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerceUnauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions. | |
| CVE-2026-42711 | 10 Oct 2026 | CVSS 7.1 | 10Web Slider by 10WebUnauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions. | |
| CVE-2026-42712 | 10 Oct 2026 | CVSS 8.5 | Qode ToursSubscriber SQL Injection in Qode Tours <= 3.1.3.2 versions. | |
| CVE-2026-42715 | 10 Oct 2026 | CVSS 7.1 | 10Web Photo Gallery by 10WebUnauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions. | |
| CVE-2026-42716 | 10 Oct 2026 | CVSS 9.8 | Payever - WooCommerce GatewayUnauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. | |
| CVE-2026-42717 | 10 Oct 2026 | CVSS 7.6 | VaultDweller LeykaAdministrator SQL Injection in Leyka <= 3.32.3 versions. | |
| CVE-2026-42718 | 10 Oct 2026 | CVSS 9.8 | Pluggabl Booster for WooCommerceUnauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions. | |
| CVE-2026-42633 | 10 Oct 2026 | CVSS 8.5 | Marcus Events ManagerSubscriber SQL Injection in Events Manager <= 7.4.6 versions. | |
| CVE-2026-42693 | 10 Oct 2026 | CVSS 7.1 | TieLabs JannahUnauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions. | |
| CVE-2026-42696 | 10 Oct 2026 | CVSS 10.0 | Royal Plugins SiteVault – Backup, Restore, Migration & CloningImproper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning… | |
| CVE-2026-42697 | 10 Oct 2026 | CVSS 7.1 | Inisev Social Share Icons & Social Share ButtonsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share… | |
| CVE-2026-42699 | 10 Oct 2026 | CVSS 7.1 | FolioVision FV Player 8Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions. | |
| CVE-2026-42702 | 10 Oct 2026 | CVSS 7.1 | Themeum Tutor LMSImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected… | |
| CVE-2026-42704 | 10 Oct 2026 | CVSS 8.1 | axiomthemes Kids CareUnauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. | |
| CVE-2026-42705 | 10 Oct 2026 | CVSS 7.5 | ThemeGoods Grand NewsUnauthenticated Broken Access Control in Grand News <= 3.4 versions. | |
| CVE-2026-40802 | 10 Oct 2026 | CVSS 7.6 | Pubjet | پابجتSubscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions. | |
| CVE-2026-40803 | 10 Oct 2026 | CVSS 7.1 | Jotform – AI ChatbotUnauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions. | |
| CVE-2026-40805 | 10 Oct 2026 | CVSS 7.7 | PeepSoSubscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions. | |
| CVE-2026-40808 | 10 Oct 2026 | CVSS 6.5 | Automattic Jetpack VideoPressSubscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. | |
| CVE-2026-42419 | 10 Oct 2026 | CVSS 5.9 | SwishFolio Swish Migrate and BackupUnauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions. | |
| CVE-2026-42630 | 10 Oct 2026 | CVSS 7.5 | Web Plura Backup & Restore ManagerUnauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. | |
| CVE-2026-42631 | 10 Oct 2026 | CVSS 7.1 | Qode MusicUnauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions. | |
| CVE-2026-42632 | 10 Oct 2026 | CVSS 7.1 | Qode Real EstateUnauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions. | |
| CVE-2026-27350 | 10 Oct 2026 | CVSS 7.2 | Builderius.io BuilderiusServer-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from… | |
| CVE-2026-39799 | 10 Oct 2026 | CVSS 7.1 | Joomunited WP File DownloadUnauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions. | |
| CVE-2026-39800 | 10 Oct 2026 | CVSS 7.1 | Anton Bond Additional Order Filters for WooCommerceUnauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions. | |
| CVE-2026-39801 | 10 Oct 2026 | CVSS 9.8 | Sergey AIWUSubscriber Privilege Escalation in AIWU <= 1.5.9 versions. | |
| CVE-2026-39802 | 10 Oct 2026 | CVSS 8.1 | everestthemes Everest BackupUnauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions. | |
| CVE-2026-40777 | 10 Oct 2026 | CVSS 8.1 | Rashid WPSectionSubscriber Broken Access Control in WPSection <= 1.5.1 versions. | |
| CVE-2026-40800 | 10 Oct 2026 | CVSS 9.3 | ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & AttributesSubscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions. | |
| CVE-2026-40801 | 10 Oct 2026 | CVSS 8.1 | WordableSubscriber Broken Access Control in Wordable <= 8.2.10 versions. | |
| CVE-2026-103685 | 10 Oct 2026 | CVSS 4.3 | VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerceMissing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting… | |
| CVE-2026-107420 | 10 Oct 2026 | CVSS 5.3 | Narinder Singh Pay With MetaMask For WooCommerce – Cryptocurrency Payment GatewayUnauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions. | |
| CVE-2026-107434 | 10 Oct 2026 | CVSS 5.4 | videowhisper MicroPaymentsSubscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions. | |
| CVE-2026-108602 | 10 Oct 2026 | CVSS 4.3 | heliconeHelicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization… | |
| CVE-2026-108603 | 10 Oct 2026 | CVSS 3.3 | addsumtech slide-makerslide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the… | |
| CVE-2026-108604 | 10 Oct 2026 | CVSS 6.3 | TabularisDB tabularisTabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or… | |
| CVE-2026-96341 | 10 Oct 2026 | CVSS 8.2 | WPMU DEV ForminatorIncorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a… | |
| CVE-2026-108596 | 10 Oct 2026 | CVSS 5.3 | openlitOpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged… | |
| CVE-2026-108597 | 10 Oct 2026 | CVSS 4.8 | cohere-ai cohere-pythonCohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file… | |
| CVE-2026-108598 | 10 Oct 2026 | CVSS 9.8 | floci-io flociFloci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via… | |
| CVE-2026-108599 | 10 Oct 2026 | CVSS 4.7 | pulseaiclub phiphi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by… | |
| CVE-2026-108600 | 10 Oct 2026 | CVSS 4.7 | open-multi-agentopen-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows… | |
| CVE-2026-57806 | 10 Oct 2026 | CVSS 7.1 | drfuri Martfury - WooCommerce Marketplace WordPress ThemeImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace… | |
| CVE-2026-94590 | 10 Oct 2026 | CVSS 6.5 | CodePeople2 Sell DownloadsImproper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted… | |
| CVE-2026-106610 | 10 Oct 2026 | CVSS 9.8 | miniorange otp verificationIncorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This… | |
| CVE-2026-108591 | 10 Oct 2026 | CVSS 4.4 | innocommerce InnoShopInnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server… | |
| CVE-2026-108592 | 10 Oct 2026 | CVSS 5.3 | SWE-agent mini-swe-agentmini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so… | |
| CVE-2026-108593 | 10 Oct 2026 | CVSS 6.4 | decolua 9router9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows… | |
| CVE-2026-108594 | 10 Oct 2026 | CVSS 3.5 | mealie-recipes mealieMealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when… | |
| CVE-2026-108595 | 10 Oct 2026 | CVSS 5.3 | pulseaiclub phiPhi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode… | |
| CVE-2026-105892 | 10 Oct 2026 | CVSS 9.8 | rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPressImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and… | |
| CVE-2026-94160 | 10 Oct 2026 | CVSS 7.1 | ThemeStek Extras for LabtechCO ThemeImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme… | |
| CVE-2026-105889 | 10 Oct 2026 | CVSS 9.3 | TickeraImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system… |
Page 93 of 168