CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-109983YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameterwssoffice21 YMC Filter
- CVE-2026-111110Payment forms, Buy now buttons, and Invoicing System cross-site scripting (XSS)stiofansisland Payment forms, Buy now buttons, and Invoicin…
- CVE-2026-110384WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerabilityHeateor Support Fancy Comments WordPress
- CVE-2026-97314ThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic InjectionThirstyAffiliates
- CVE-2026-81344Frontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object InjectionACF Frontend Admin by DynamiApps
- CVE-2026-81343Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form SubmissionACF Frontend Admin by DynamiApps
- CVE-2026-110527WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment BypassWP User Manager
- CVE-2026-106470WP Data Access < 5.5.88 - Subscriber+ SSRFWP Data Access
- CVE-2026-103376PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status CheckPeachPay — Payments & Express Checkout for WooCommerce
- CVE-2026-104122Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term NameUkr-To-Lat
- CVE-2026-92432Patreon WordPress < 1.10.0 - Open Redirect via 'state' ParameterPatreon WordPress
- CVE-2026-92431Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term EnumerationPatreon WordPress
- CVE-2026-92433Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRFPatreon WordPress
- CVE-2026-104246Contact Form 7 Signature Addon arbitrary file read via path traversal in email attachmentsContact Form 7 Signature Addon
- CVE-2026-91074BSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode AttributeBSK PDF Manager
- CVE-2026-92798The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the…wpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-103899EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameterdaigo75 EU VAT Assistant for WooCommerce
- CVE-2026-109989Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameterthemifyme Themify Popup
- CVE-2026-107744LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Actionthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-111726Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attributethemifyme Themify Builder
- CVE-2026-108123WP Booking System authorization bypassmurgroland WP Booking System – Booking Calendar
- CVE-2026-92978User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()wpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-109369WP Booking System authorization bypassmurgroland WP Booking System – Booking Calendar
- CVE-2026-96660User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Valuewpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2026-104736LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameterthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-109368The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' parametermurgroland WP Booking System – Booking Calendar
- CVE-2026-92715The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to…themeum Tutor LMS – eLearning and online course solution
- CVE-2026-107752Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookieuscnanbu Welcart e-Commerce
- CVE-2026-109985xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN cross-site scripting (XSS)wpdevteam xSpeed Cache: AI-Powered Performance Hub with MCP…
- CVE-2026-110268Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameterwpazleen Post Export Import with Media