CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-109381Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parametermagepeopleteam Event Booking Manager for WooCommerce – Sell…
- CVE-2026-103370Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusionawesomesupport Awesome Support – WordPress HelpDesk & Suppo…
- CVE-2026-116609WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attributeosamaesh WP Visitor Statistics
- CVE-2026-115281Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' AttributeRecipe Card Blocks Lite
- CVE-2026-115255WP Roster < 2.35 - Unauthenticated Roster Member DeletionWP Roster
- CVE-2026-115225Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups LookupCustomer Engagement System
- CVE-2026-115224Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category BindingCustomer Engagement System
- CVE-2026-113813PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and DisclosurePayPlug for WooCommerce
- CVE-2026-113494GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content ShortcodeGeoDirectory
- CVE-2026-113488GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' AttributeGeoDirectory
- CVE-2026-113487GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' AttributeGeoDirectory
- CVE-2026-113486Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRFMedia Library Assistant
- CVE-2026-113485Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRFMedia Library Assistant
- CVE-2026-111967MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode AttributeMP3 Audio Player
- CVE-2026-111961Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_pageRoyal MCP
- CVE-2026-111960Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search AbilityRoyal MCP
- CVE-2026-111577GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP SettingsGoSMTP
- CVE-2026-111032Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajaxWelcart e-Commerce
- CVE-2026-111031Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' ParameterWelcart e-Commerce
- CVE-2026-111027Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' ParameterWelcart e-Commerce
- CVE-2026-111021Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameterافزونه پیامک ووکامرس | Persian WooCommerce SMS
- CVE-2026-110691WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug UpdateWPOrLogin
- CVE-2026-110524Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode AttributeCopy Anything to Clipboard for WordPress
- CVE-2026-110509Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX HandlerEssential Addons for Elementor
- CVE-2026-110507Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query ArgumentsPage Builder by SiteOrigin
- CVE-2026-110506Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.classPage Builder by SiteOrigin
- CVE-2026-110292PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intentPayPlug for WooCommerce
- CVE-2026-107100Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_contentRoyal Addons for Elementor
- CVE-2026-107098Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height SettingRoyal Addons for Elementor
- CVE-2026-107097Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribeRoyal Addons for Elementor