CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-115840VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parametere4jvikwp VikRentCar Car Rental Management System
- CVE-2026-107750PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name /…wpovernight PDF Invoices & Packing Slips for WooCommerce
- CVE-2026-88942Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameterwoobewoo Product Filter for WooCommerce by WBW
- CVE-2026-119980UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hashstiofansisland UsersWP – Front-end login form, User Registr…
- CVE-2026-90960Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directoryseraphinitesoft Seraphinite Accelerator
- CVE-2026-119162User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via…specialk User Submitted Posts – Enable Users to Submit Post…
- CVE-2026-107765Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Fieldmarketingfire Discussion Board – WordPress Forum Plugin
- CVE-2026-120040Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer /…wardee Mail logging & Catcher
- CVE-2026-116546WP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameterwpjobportal WP Job Portal – AI-Powered Recruitment System f…
- CVE-2026-116522Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decodecomesio Relevanssi – A Better Search
- CVE-2026-119089ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tagsupercleanse ThirstyAffiliates – Affiliate Links, Link Bran…
- CVE-2026-120019W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholderboldgrid W3 Total Cache
- CVE-2026-107653SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of…SureCart – Ecommerce Made Easy For Selling Physical Product…
- CVE-2026-119163FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameterteamfunnelkit FunnelKit Automations – Email Marketing Autom…
- CVE-2026-109220PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via…addonsorg PDF Invoice for WooCommerce + Drag and Drop Templ…
- CVE-2026-89270Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id'…popupbuilder Popup Builder – Create highly converting, mobi…
- CVE-2026-111109Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tagpfefferle Webmention
- CVE-2026-111254W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiryboldgrid W3 Total Cache
- CVE-2026-94361PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned CallbackPayable Payment Gateway for WooCommerce
- CVE-2026-82214Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS DownloadQuick Event Manager
- CVE-2026-118638Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST RouteMapster WP Maps
- CVE-2026-118629All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video DisclosureAll-in-One Video Gallery
- CVE-2026-118438Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' AttributeFirelight Lightbox
- CVE-2026-118437BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment DeletionBuddyForms
- CVE-2026-118185Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate LimitingSecurity Optimizer
- CVE-2026-118184Premium Packages < 7.2.2 - Unauthenticated Order Total ManipulationPremium Packages
- CVE-2026-118043Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path TraversalBulk Media Register
- CVE-2026-110808Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_roleEssential Addons for Elementor
- CVE-2026-110042Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings PagePayment Forms for Paystack
- CVE-2026-116520PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker…buildwps PPWP – Password Protect Pages