CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-107710Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Titlewpmudev Hustle – Email Marketing, Lead Generation, Optins,…
- CVE-2026-109988Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameteracowebs Product Addons for Woocommerce – Product Options wi…
- CVE-2026-2839Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpointshwk-fr Advanced Custom Fields: Extended
- CVE-2026-116761CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Formjtsternberg CMB2
- CVE-2026-108366easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attributewpdevteam easy.jobs – AI powered Job Listing, Job Board, Ca…
- CVE-2026-110071Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attributekitae-park Mang Board
- CVE-2026-111111Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escapebdthemes Prime Slider – Hero Slider, Carousel, WooCommerce…
- CVE-2026-111213Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parametermagepeopleteam Travelly – Tour & Travel Booking Manager for…
- CVE-2026-116610Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hookhornero Clean Login
- CVE-2026-116749VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attributee4jvikwp VikRentCar Car Rental Management System
- CVE-2026-92098Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameterwebheadllc Webheadcoder Multi-Step Forms for Contact Form
- CVE-2026-109980Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameterbarrykooij Related Posts for WordPress
- CVE-2026-104729Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributesthemefusion Avada (Fusion) Builder
- CVE-2026-118164If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameterifso If-So Dynamic Content – Elementor & All Page Builders…
- CVE-2026-100175Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolinkwayneallen-1 Postie
- CVE-2026-109384The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public…melograno The Innovative Form Builder – IvyForms
- CVE-2026-77188Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attributexootix Waitlist Woocommerce
- CVE-2026-110020Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Pagewidgetpack Rich Showcase for Google Reviews
- CVE-2026-109979Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameterbarrykooij Related Posts for WordPress
- CVE-2026-111120VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Taske4jvikwp VikRentCar Car Rental Management System
- CVE-2026-104740If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attributeifso If-So Dynamic Content – Elementor & All Page Builders…
- CVE-2026-111372AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Actionquantumcloud AI ChatBot for WooCommerce – WoowBot
- CVE-2026-109978Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attributecozythemes Cozy Blocks – Website Builder & Business Growth…
- CVE-2026-76058PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Actionodefranca PayPal Brasil para WooCommerce
- CVE-2026-109972s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attributeclavaque s2Member – Excellent for All Kinds of Memberships,…
- CVE-2026-111068DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attributejustinnealey DesignSetGo
- CVE-2026-109590Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributesmagepeopleteam Travelly – Tour & Travel Booking Manager for…
- CVE-2026-109385UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URLposimyththemes UiChemy – Convert Figma, Prompts and AI Buil…
- CVE-2026-103996If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attributeifso If-So Dynamic Content – Elementor & All Page Builders…
- CVE-2026-110662MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_ratingMxChat – AI Chatbot & Content Generation for WordPress