[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108503 | 10 Oct 2026 | CVSS 3.3 | ZTE Z80 UltraZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An… | |
| CVE-2026-12626 | 10 Oct 2026 | CVSS 7.2 | ladela Online Scheduling and Appointment Booking System – BooklyThe Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and… | |
| CVE-2026-15178 | 10 Oct 2026 | CVSS 5.4 | wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form BuilderThe Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin… | |
| CVE-2026-3717 | 10 Oct 2026 | CVSS 5.3 | bestwpdeveloper WP CV BuilderThe CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing… | |
| CVE-2026-5725 | 10 Oct 2026 | CVSS 6.1 | archetyped Favicon RotatorThe Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt_' prefixed request parameters in all versions… | |
| CVE-2026-6243 | 10 Oct 2026 | CVSS 6.4 | shabti Frontend Admin by DynamiAppsThe Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up… | |
| CVE-2026-89100 | 10 Oct 2026 | CVSS 6.1 | paymentplugins Payment Plugins for Stripe WooCommerceThe Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '#response' URL Fragment in all… | |
| CVE-2026-103427 | 10 Oct 2026 | CVSS 6.4 | wpinsider-1 Simple MembershipThe Simple Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'country' parameter in all versions up to, and… | |
| CVE-2026-103897 | 10 Oct 2026 | CVSS 4.4 | dfactory Responsive Lightbox & GalleryThe Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up… | |
| CVE-2026-104006 | 10 Oct 2026 | CVSS 3.7 | softaculous SpeedyCache – Cache, Optimization, PerformanceThe SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… | |
| CVE-2026-104801 | 10 Oct 2026 | CVSS 9.1 | themeisle PPOM – Product Addons & Custom Fields for WooCommerceThe PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path… | |
| CVE-2026-107712 | 10 Oct 2026 | CVSS 6.5 | murgroland WP Booking System – Booking CalendarThe WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all… | |
| CVE-2026-107742 | 10 Oct 2026 | CVSS 7.2 | 10Web Booster – Website speed optimization, Cache & Page Speed optimizerThe 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | |
| CVE-2026-108502 | 10 Oct 2026 | CVSS 3.3 | ZTE Z80 UltraZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking… | |
| CVE-2026-100196 | 10 Oct 2026 | CVSS 7.2 | wp_media LazyLoad Plugin – Lazy Load Images, Videos, and IframesThe LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-102402 | 10 Oct 2026 | CVSS 6.4 | techlabpro1 Team – Team Members Showcase PluginThe Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the… | |
| CVE-2026-100161 | 10 Oct 2026 | CVSS 7.2 | villatheme Photo Reviews for WooCommerceThe Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id'… | |
| CVE-2026-94421 | 10 Oct 2026 | CVSS 6.4 | andy_moyle Church AdminThe Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including… | |
| CVE-2026-96667 | 10 Oct 2026 | CVSS 7.2 | rameez_iqbal Real Estate Manager – Property Listing and Agent ManagementThe Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-96682 | 10 Oct 2026 | CVSS 7.2 | 2winfactor Presto PlayerThe Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up… | |
| CVE-2026-97643 | 10 Oct 2026 | CVSS 6.4 | stellarwp GiveWP – Donation Plugin and Fundraising PlatformThe GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… | |
| CVE-2026-91862 | 10 Oct 2026 | CVSS 6.4 | jetmonsters Getwid – Gutenberg BlocksThe Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions… | |
| CVE-2026-92975 | 10 Oct 2026 | CVSS 8.1 | trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing AutomationThe Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and… | |
| CVE-2026-93775 | 10 Oct 2026 | CVSS 7.2 | eteubert Podlove Podcast PublisherThe Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and… | |
| CVE-2026-94256 | 10 Oct 2026 | CVSS 8.1 | Unknown SMS AlertThe SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to… | |
| CVE-2026-94257 | 10 Oct 2026 | CVSS 8.1 | Unknown SMS AlertThe SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified… | |
| CVE-2026-94375 | 10 Oct 2026 | CVSS 5.3 | webtoffee Order Export & Order Import for WooCommerceThe Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… | |
| CVE-2026-77183 | 10 Oct 2026 | CVSS 8.8 | FooSales – Point of Sale (POS) for WooCommerceThe FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up… | |
| CVE-2026-78068 | 10 Oct 2026 | CVSS 6.4 | jonua Table Field Add-on for ACF and SCFThe Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up… | |
| CVE-2026-83526 | 10 Oct 2026 | CVSS 8.8 | foliovision FV Player 8The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimetype… | |
| CVE-2026-85571 | 10 Oct 2026 | CVSS 6.5 | Unknown Tutor LMSThe Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the… | |
| CVE-2026-87780 | 10 Oct 2026 | CVSS 8.8 | Unknown LTL Freight QuotesThe LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before… | |
| CVE-2026-87781 | 10 Oct 2026 | CVSS 8.6 | Unknown LTL Freight QuotesThe LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… | |
| CVE-2026-91050 | 10 Oct 2026 | CVSS 4.3 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object… | |
| CVE-2026-16776 | 10 Oct 2026 | CVSS 6.4 | sonaar MP3 Audio Player – Music Player, Podcast Player & Radio by SonaarThe MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode… | |
| CVE-2026-17025 | 10 Oct 2026 | CVSS 6.4 | silverks GrapheneThe Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in… | |
| CVE-2026-18496 | 10 Oct 2026 | CVSS 5.3 | wpdevelop Booking CalendarThe Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the… | |
| CVE-2026-18558 | 10 Oct 2026 | CVSS 6.4 | awsmin Embed Any Document – Embed PDF, Word, PowerPoint and Excel FilesThe Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-107321 | 10 Oct 2026 | CVSS 5.4 | Unknown W3 Total CacheThe W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type… | |
| CVE-2026-107323 | 10 Oct 2026 | CVSS 6.8 | Unknown Gallery PhotoBlocksThe Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML… | |
| CVE-2026-12054 | 10 Oct 2026 | CVSS 6.1 | codename065 Download ManagerThe Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and… | |
| CVE-2026-14335 | 10 Oct 2026 | CVSS 7.2 | smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easyThe Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | |
| CVE-2026-14379 | 10 Oct 2026 | CVSS 6.4 | rubengc GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AIThe GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored… | |
| CVE-2026-14877 | 10 Oct 2026 | CVSS 6.4 | supsysticcom Data Tables Generator by SupsysticThe Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to… | |
| CVE-2026-14882 | 10 Oct 2026 | CVSS 6.4 | themefusecom Brizy – Page BuilderThe Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all… | |
| CVE-2026-104766 | 10 Oct 2026 | CVSS 8.8 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all… | |
| CVE-2026-104899 | 10 Oct 2026 | CVSS 8.1 | paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings DirectoryThe GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all… | |
| CVE-2026-105976 | 10 Oct 2026 | CVSS 4.7 | Unknown Portfolio Filter GalleryThe Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with… | |
| CVE-2026-105977 | 10 Oct 2026 | CVSS 2.2 | Unknown Portfolio Filter GalleryThe Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing… | |
| CVE-2026-105989 | 10 Oct 2026 | CVSS 5.3 | Unknown Accept PayPal Payments using Contact Form 7The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one… | |
| CVE-2026-105990 | 10 Oct 2026 | CVSS 5.3 | Unknown Accept PayPal Payments using Contact Form 7The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form… | |
| CVE-2026-105995 | 10 Oct 2026 | CVSS 5.3 | Unknown Booking PackageThe Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing… | |
| CVE-2026-107120 | 10 Oct 2026 | CVSS 5.3 | Unknown Contest GalleryThe Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step… | |
| CVE-2026-104741 | 10 Oct 2026 | CVSS 3.1 | senols AI Puffer – AI Chatbot, AI Writer & AutomationThe AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… | |
| CVE-2026-104742 | 10 Oct 2026 | CVSS 3.1 | senols AI Puffer – AI Chatbot, AI Writer & AutomationThe AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… | |
| CVE-2026-104752 | 10 Oct 2026 | CVSS 7.2 | Unknown Rank Math SEOThe Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature… | |
| CVE-2026-104753 | 10 Oct 2026 | CVSS 4.1 | Unknown Rank Math SEOThe Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing… | |
| CVE-2026-104754 | 10 Oct 2026 | CVSS 3.5 | Unknown Rank Math SEOThe Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list… | |
| CVE-2026-104762 | 10 Oct 2026 | CVSS 6.4 | stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg EditorThe Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font… | |
| CVE-2026-104763 | 10 Oct 2026 | CVSS 4.9 | wpazleen Post Export Import with MediaThe Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the… | |
| CVE-2026-103520 | 10 Oct 2026 | CVSS 6.4 | HivePress – Business Directory, Listings & Classified Ads PluginThe HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-103912 | 10 Oct 2026 | CVSS 4.7 | jetmonsters JetFormBuilder — Dynamic Blocks Form BuilderThe JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the… | |
| CVE-2026-104023 | 10 Oct 2026 | CVSS 4.9 | supsysticcom Smart Popup by SupsysticThe Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and… | |
| CVE-2026-104723 | 10 Oct 2026 | CVSS 8.8 | LifterLMS – WP LMS for eLearning, Online Courses, & QuizzesThe LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and… | |
| CVE-2026-104725 | 10 Oct 2026 | CVSS 8.8 | trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing AutomationThe Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and… | |
| CVE-2026-103482 | 10 Oct 2026 | CVSS 5.4 | picocodes Noptin – Newsletter, New Post Notifications & Email AutomationThe Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-5727 | 10 Oct 2026 | CVSS 5.4 | elemntor Hello PlusThe Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not… | |
| CVE-2026-6723 | 10 Oct 2026 | CVSS 5.3 | croixhaug Simply Schedule AppointmentsThe Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Incorrect Authorization in all… | |
| CVE-2026-87869 | 10 Oct 2026 | CVSS 6.1 | stepasyuk Filter Everything — WordPress & WooCommerce FiltersThe Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and… | |
| CVE-2026-89301 | 10 Oct 2026 | CVSS 7.5 | rtcamp rtMedia for WordPress, BuddyPress and bbPressThe rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path… | |
| CVE-2026-96648 | 10 Oct 2026 | CVSS 6.4 | supsysticcom Data Tables Generator by SupsysticThe Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows… | |
| CVE-2026-97630 | 10 Oct 2026 | CVSS 6.4 | foliovision FV Flowplayer Video PlayerThe FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all… | |
| CVE-2026-97670 | 10 Oct 2026 | CVSS 9.1 | themefusion Avada (Fusion) BuilderThe Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to… | |
| CVE-2026-9696 | 10 Oct 2026 | CVSS 6.4 | codename065 Download ManagerThe Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and… | |
| CVE-2026-103424 | 10 Oct 2026 | CVSS 5.4 | cleantalk Anti-Spam by CleanTalk – Spam Protection Without CAPTCHAThe Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'… | |
| CVE-2026-103889 | 10 Oct 2026 | CVSS 9.8 | expivi 3D Product configurator for WooCommerceThe 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2… | |
| CVE-2026-103964 | 10 Oct 2026 | CVSS 4.3 | codename065 Download ManagerThe Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the… | |
| CVE-2026-103998 | 10 Oct 2026 | CVSS 6.1 | 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form BuilderThe Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via… | |
| CVE-2026-104021 | 10 Oct 2026 | CVSS 7.2 | hostspa Fastcache by Host.itThe Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the… | |
| CVE-2026-104724 | 10 Oct 2026 | CVSS 5.3 | fireplugins FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart AbandonmentThe FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL… | |
| CVE-2026-104735 | 10 Oct 2026 | CVSS 6.4 | themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds AggregatorThe RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored… | |
| CVE-2026-104993 | 10 Oct 2026 | CVSS 6.4 | paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings DirectoryThe GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting… | |
| CVE-2026-101324 | 10 Oct 2026 | CVSS 4.7 | wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form BuilderThe Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site… | |
| CVE-2026-102401 | 10 Oct 2026 | CVSS 6.4 | codename065 Download ManagerThe Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter in all versions up to, and… | |
| CVE-2026-96743 | 10 Oct 2026 | CVSS 6.4 | jonua Table Field Add-on for ACF and SCFThe Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to… | |
| CVE-2026-94589 | 10 Oct 2026 | CVSS 9.8 | htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection)The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in… | |
| CVE-2026-107645 | 10 Oct 2026 | CVSS 9.1 | creativethemeshq Blocksy CompanionThe Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the… | |
| CVE-2026-108501 | 10 Oct 2026 | CVSS 5.7 | ZTE Z80 UltraZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be… | |
| CVE-2026-103365 | 10 Oct 2026 | CVSS 5.3 | ladela Online Scheduling and Appointment Booking System – BooklyThe Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to… | |
| CVE-2026-104732 | 10 Oct 2026 | CVSS 9.8 | inilerm Advanced IP BlockerThe Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 8.13.13 The vulnerability… | |
| CVE-2026-104797 | 10 Oct 2026 | CVSS 8.1 | nasirahmed Advanced Form Integration — Connect Forms to 300+ AppsThe Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Authentication Bypass via Unverified Password Change… | |
| CVE-2026-104898 | 10 Oct 2026 | CVSS 6.8 | ladela Online Scheduling and Appointment Booking System – BooklyThe Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… | |
| CVE-2026-101947 | 10 Oct 2026 | CVSS 8.4 | CellHubs ExifTool for photo and videoExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export… | |
| CVE-2026-93883 | 10 Oct 2026 | CVSS 6.4 | pluginsware Advanced Classifieds & Directory ProThe Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter in all versions… | |
| CVE-2026-104915 | 10 Oct 2026 | CVSS 6.5 | kodezen Academy LMS – AI Course Builder, Quizzes, Certificates & eLearningThe Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up… | |
| CVE-2026-104022 | 10 Oct 2026 | CVSS 5.4 | kodezen Academy LMS – AI Course Builder, Quizzes, Certificates & eLearningThe Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Privilege Escalation in all versions up… | |
| CVE-2026-108474 | 10 Oct 2026 | CVSS 9.8 | JetBrains ExposedIn JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions | |
| CVE-2026-22061 | 9 Oct 2026 | CVSS 8.2 | NetApp TridentTrident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to… | |
| CVE-2026-108267 | 9 Oct 2026 | CVSS 9.1 | Privasys goPrivasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5… | |
| CVE-2026-108268 | 9 Oct 2026 | CVSS 9.1 | Privasys enclave-os-virtualEnclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and… |
Page 95 of 168