CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-115869Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Fieldthemifyme Themify Builder
- CVE-2026-109984FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Commentsfoliovision FV Flowplayer Video Player
- CVE-2026-104744Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' ParameterIndependent Analytics Pro
- CVE-2026-112365easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameterwpdevteam easy.jobs – AI powered Job Listing, Job Board, Ca…
- CVE-2026-115346Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload FieldThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2026-115820Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameterahmadmj Majestic Support – The Leading-Edge Help Desk & Cus…
- CVE-2026-118205Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revisionwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2026-109592OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+)…wordpressdotorg OpenStation – Admin Dashboard Notes, Custom…
- CVE-2026-102918Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_iddavidanderson Redux Framework
- CVE-2026-102905Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameterspacetime Ad Inserter – Ad Manager & AdSense Ads
- CVE-2026-110533FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributesfoliovision FV Flowplayer Video Player
- CVE-2026-104739JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameterrabilal JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2026-96894ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email…wedevs ERP: Complete HR, Accounting & CRM Suite Built for W…
- CVE-2026-97638Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via…wpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-118635GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameterpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-107630Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII…saadiqbal Email Templates Customizer and Designer for WordP…
- CVE-2026-9239Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)tigroumeow Meow Gallery
- CVE-2026-116552Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' HeaderLike Button Rating ♥ LikeBtn
- CVE-2026-110305Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via…hwk-fr Advanced Custom Fields: Extended
- CVE-2026-110001FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attributefoliovision FV Flowplayer Video Player
- CVE-2025-8574Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletiontigroumeow Database Cleaner: Cleanup, Optimization & Repair
- CVE-2026-13747Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpointtigroumeow Meow Gallery
- CVE-2026-119176CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parametercodepeople CP Multi View Events Calendar
- CVE-2026-11961937954679 cak-filemanagement-system save_student.php mysqli_query sql injection37954679 cak-filemanagement-system
- CVE-2026-61826Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request…morpheus65535 bazarr
- CVE-2026-50000SecureDrop: API session token reuse against the Journalist Interface web UIfreedomofpress securedrop
- CVE-2026-61804myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category ManagementmyTinyWMS
- CVE-2026-61806Frappe LMS allows unpublished certificate accessfrappe lms
- CVE-2026-61805Frappe LMS: Quiz result manipulation and cross-user submission forgeryfrappe lms
- CVE-2026-61803Frappe LMS: Client-controlled price allows paid-course / certificate purchase for an arbitrary amountfrappe lms