[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106608 | 10 Oct 2026 | CVSS 7.2 | Automattic WooCommerceIncorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from… | |
| CVE-2026-106609 | 10 Oct 2026 | CVSS 7.5 | Web Impian Bayarcash WooCommerceMissing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-108585 | 10 Oct 2026 | CVSS 5.4 | argoproj-labs argocd-mcpargocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach… | |
| CVE-2026-108586 | 10 Oct 2026 | CVSS 5.4 | 1mcp-app @1mcp/agent1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth… | |
| CVE-2026-62044 | 10 Oct 2026 | CVSS 7.2 | bPlugins Super Video PlayerDeserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super… | |
| CVE-2026-103071 | 10 Oct 2026 | CVSS 7.5 | VillaTheme Thank You Page Customizer for WooCommerceImproper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce… | |
| CVE-2026-103357 | 10 Oct 2026 | CVSS 6.9 | VillaTheme GIFT4UMissing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-104398 | 10 Oct 2026 | CVSS 9.8 | VillaTheme AFFI – Affiliate Marketing for WooCommerceDeserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows… | |
| CVE-2026-108579 | 10 Oct 2026 | CVSS 4.2 | Openpanel-dev openpanelOpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by… | |
| CVE-2026-108580 | 10 Oct 2026 | CVSS 6.5 | phoenixthrush AniWorld DownloaderAniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that… | |
| CVE-2026-108581 | 10 Oct 2026 | CVSS 6.5 | TencentCloud OctopTencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored… | |
| CVE-2026-108582 | 10 Oct 2026 | CVSS 5.5 | genspark-ai GenOfficeGenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to… | |
| CVE-2026-108583 | 10 Oct 2026 | CVSS 4.2 | 54yyyu zotero-mcpzotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because… | |
| CVE-2026-108550 | 10 Oct 2026 | CVSS 8.8 | iflytek skillhubSkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated… | |
| CVE-2026-108551 | 10 Oct 2026 | CVSS 9.8 | ferdikoomen openapi-typescript-codegenopenapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject… | |
| CVE-2026-108553 | 10 Oct 2026 | CVSS 7.5 | OpenRefineOpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython… | |
| CVE-2026-108554 | 10 Oct 2026 | CVSS 5.3 | PDFMathTranslatePDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the… | |
| CVE-2026-108555 | 10 Oct 2026 | CVSS 4.2 | schlagmichdoch PairDropPairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by… | |
| CVE-2026-108115 | 10 Oct 2026 | CVSS 4.9 | kortix-ai sunaKortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard… | |
| CVE-2026-108545 | 10 Oct 2026 | CVSS 5.9 | SillyTavernSillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources… | |
| CVE-2026-108546 | 10 Oct 2026 | CVSS 7.5 | spotwebSpotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands… | |
| CVE-2026-108547 | 10 Oct 2026 | CVSS 6.5 | iflytek astron-rpaAstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared… | |
| CVE-2026-108548 | 10 Oct 2026 | CVSS 7.3 | iflytek astron-rpaAstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token… | |
| CVE-2026-108549 | 10 Oct 2026 | CVSS 8.1 | chenhg5 cc-connectcc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts… | |
| CVE-2026-108114 | 10 Oct 2026 | CVSS 4.3 | strapiStrapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access… | |
| CVE-2026-66435 | 10 Oct 2026 | CVSS 5.9 | Devin Walker WP RollbackInsertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This… | |
| CVE-2026-94676 | 10 Oct 2026 | CVSS 7.2 | Tainacan Community TainacanDeserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a… | |
| CVE-2026-97263 | 10 Oct 2026 | CVSS 7.1 | Greg Winiarski WPAdvertsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows… | |
| CVE-2026-97264 | 10 Oct 2026 | CVSS 7.1 | Greg Winiarski WPAdvertsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows… | |
| CVE-2026-105885 | 10 Oct 2026 | CVSS 8.8 | 10Web Slider by 10WebDeserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from… | |
| CVE-2026-108161 | 10 Oct 2026 | CVSS 7.5 | fusionpbxFusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to… | |
| CVE-2026-108162 | 10 Oct 2026 | CVSS 6.5 | smp46 pingvin-share-xPingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling… | |
| CVE-2026-108163 | 10 Oct 2026 | CVSS 6.5 | smp46 pingvin-share-xPingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted… | |
| CVE-2026-108164 | 10 Oct 2026 | CVSS 6.5 | opensource-socialnetworkOpen Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php… | |
| CVE-2026-108165 | 10 Oct 2026 | CVSS 4.3 | immich-app immichImmich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read… | |
| CVE-2026-102388 | 10 Oct 2026 | CVSS 7.1 | WPMU DEV ForminatorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored… | |
| CVE-2026-107373 | 10 Oct 2026 | CVSS 9.1 | VulnerabilityExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The… | |
| CVE-2026-107794 | 10 Oct 2026 | CVSS 7.5 | VulnerabilityExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1… | |
| CVE-2013-10076 | 10 Oct 2026 | CVSS 7.5 | VulnerabilityExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1… | |
| CVE-2026-103636 | 10 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache DataSketchesOut-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the… | |
| CVE-2026-103513 | 10 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache DataSketchesOut-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CPC sketch… | |
| CVE-2026-103635 | 10 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache DataSketchesOut-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)… | |
| CVE-2026-103501 | 10 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache DataSketchesHeap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode… | |
| CVE-2026-108506 | 10 Oct 2026 | CVSS 5.5 | ZTE Z80 UltraZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the… | |
| CVE-2026-106139 | 10 Oct 2026 | CVSS 5.4 | Progress Software Kendo UI for VueIn Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the… | |
| CVE-2026-106138 | 10 Oct 2026 | CVSS 5.4 | Progress Software KendoReactIn Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the… | |
| CVE-2026-108505 | 10 Oct 2026 | CVSS 3.3 | ZTE Z80 UltraZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain… | |
| CVE-2026-4791 | 10 Oct 2026 | CVSS 6.4 | PeproDev Ultimate Profile SolutionsThe PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button'… | |
| CVE-2026-91136 | 10 Oct 2026 | CVSS 7.5 | Divi Essential Divi PlusThe Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the… | |
| CVE-2026-107657 | 10 Oct 2026 | CVSS 7.2 | HivePress – Business Directory, Listings & Classified Ads PluginThe HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-104722 | 10 Oct 2026 | CVSS 4.9 | webilia Listdom: AI-powered Business Directory with Classifieds Ads ListingsThe Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to… | |
| CVE-2026-96662 | 10 Oct 2026 | CVSS 7.5 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via… | |
| CVE-2026-96765 | 10 Oct 2026 | CVSS 7.2 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-97340 | 10 Oct 2026 | CVSS 6.4 | ThemeFusion Avada | Website Builder For WordPress & WooCommerceThe Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author… | |
| CVE-2026-97396 | 10 Oct 2026 | CVSS 6.4 | retainful Email Marketing for WordPress and WooCommerce – RetainfulThe Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data'… | |
| CVE-2026-93945 | 10 Oct 2026 | CVSS 9.8 | Axiomthemes BalanceDeserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through… | |
| CVE-2026-93949 | 10 Oct 2026 | CVSS 7.1 | Omegathemes Grocery Shopping StoreAuthentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password… | |
| CVE-2026-93950 | 10 Oct 2026 | CVSS 7.5 | StylemixThemes MotorsMissing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-93951 | 10 Oct 2026 | CVSS 7.1 | Bracketweb ZeinetImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected… | |
| CVE-2026-96278 | 10 Oct 2026 | CVSS 7.2 | opajaap WP Photo Album PlusThe WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and… | |
| CVE-2026-96563 | 10 Oct 2026 | CVSS 6.4 | stylemix Motors – Car Dealership & Classified Listings PluginThe Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s'… | |
| CVE-2026-96653 | 10 Oct 2026 | CVSS 6.5 | wpdirectorykit WP Directory KitThe WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions… | |
| CVE-2026-93936 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group IPharmDeserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through… | |
| CVE-2026-93937 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group HygiaDeserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through… | |
| CVE-2026-93938 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group HogwordsDeserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a… | |
| CVE-2026-93940 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group GreenyDeserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through… | |
| CVE-2026-93941 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group EdemaDeserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through… | |
| CVE-2026-93942 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group DwellDeserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through… | |
| CVE-2026-93943 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group ConvexDeserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through… | |
| CVE-2026-93944 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group CameliaDeserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a… | |
| CVE-2026-93927 | 10 Oct 2026 | CVSS 9.8 | Axiomthemes VetoDeserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0. | |
| CVE-2026-93929 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group TravesiaDeserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a… | |
| CVE-2026-93930 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group TantraDeserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through… | |
| CVE-2026-93931 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group SmashDeserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through… | |
| CVE-2026-93932 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group Smart CasaDeserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from… | |
| CVE-2026-93933 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group RosalindaDeserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a… | |
| CVE-2026-93934 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group PartisoDeserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a… | |
| CVE-2026-93935 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group Let's PlayDeserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from… | |
| CVE-2026-104759 | 10 Oct 2026 | CVSS 8.1 | WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce… | |
| CVE-2026-104803 | 10 Oct 2026 | CVSS 9.8 | whyun WPCOM MemberThe WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code`… | |
| CVE-2026-106606 | 10 Oct 2026 | CVSS 7.2 | YITH WooCommerce AffiliatesDeserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue… | |
| CVE-2026-108504 | 10 Oct 2026 | CVSS 5.5 | ZTE Z80 UltraZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An… | |
| CVE-2026-62045 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group BookloversDeserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from… | |
| CVE-2026-62046 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Group GutentypeDeserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a… | |
| CVE-2026-93746 | 10 Oct 2026 | CVSS 7.5 | WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping LabelsThe WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object… | |
| CVE-2026-100178 | 10 Oct 2026 | CVSS 7.2 | gwin WPAdverts – Classifieds PluginThe WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all… | |
| CVE-2026-101920 | 10 Oct 2026 | CVSS 7.2 | Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPressThe Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site… | |
| CVE-2026-101921 | 10 Oct 2026 | CVSS 4.7 | smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & MoreThe WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected… | |
| CVE-2026-102291 | 10 Oct 2026 | CVSS 5.4 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions… | |
| CVE-2026-102774 | 10 Oct 2026 | CVSS 6.4 | brainstormforce SureDash – Community, Courses & Member DashboardThe SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt'… | |
| CVE-2026-103478 | 10 Oct 2026 | CVSS 6.4 | codename065 Premium Packages – Sell Digital Products SecurelyThe Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-104728 | 10 Oct 2026 | CVSS 4.3 | rubengc AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AIThe AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass… | |
| CVE-2026-100147 | 10 Oct 2026 | CVSS 7.2 | teamfunnelkit FunnelKit – Funnel Builder for WooCommerce CheckoutThe FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-94538 | 10 Oct 2026 | CVSS 8.1 | JoomUnited WP File DownloadThe WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the… | |
| CVE-2026-95684 | 10 Oct 2026 | CVSS 7.2 | e4jvikwp VikBooking Hotel Booking Engine & PMSThe VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all… | |
| CVE-2026-96558 | 10 Oct 2026 | CVSS 7.2 | expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey MakerThe Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the… | |
| CVE-2026-96572 | 10 Oct 2026 | CVSS 7.2 | aguidrevitch WP Meteor Website Speed Optimization AddonThe WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all… | |
| CVE-2026-96574 | 10 Oct 2026 | CVSS 6.4 | wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post SubmissionThe User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for… | |
| CVE-2026-96840 | 10 Oct 2026 | CVSS 7.2 | wpxpo Post Grid Gutenberg Blocks – PostXThe Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions… | |
| CVE-2026-97348 | 10 Oct 2026 | CVSS 6.5 | gpriday SiteOrigin Widgets BundleThe SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the… |
Page 94 of 168