CVEs
Every CVE and security advisory cve.now tracks, newest first. Search narrows them by severity, exploitation, vendor, technology and package ecosystem.
- CVE-2026-120075WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scriptingmelapress WP Activity Log
- CVE-2026-103882Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' ParameterAcadlix LMS – AI Quiz Maker, Online Exam & Course Plugin fo…
- CVE-2026-119160Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter blockshapedplugin Smart Post – Post Grid, Post Carousel, Post Sl…
- CVE-2026-109367All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parametersmub All in One SEO – AI SEO Plugin to Boost SEO Rankings &…
- CVE-2026-118235SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_datawpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Po…
- CVE-2026-103915Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parametermelograno Booking for Appointments and Events Calendar – Am…
- CVE-2026-120070User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameterwedevs User Frontend – Membership, User Registration, User…
- CVE-2026-103898Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social…roxnor Wp Social Login and Register Social Counter
- CVE-2026-111070Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`pluginever Content Pilot – Autoblogging & Affiliate Marketi…
- CVE-2026-107759WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mailWPO365 | MICROSOFT 365 GRAPH MAILER
- CVE-2026-116512Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injectionwedevs Project Manager – AI Powered Project Management, Tas…
- CVE-2026-103997Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via…davidanderson Redux Framework
- CVE-2025-11455Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacementtigroumeow Perfect Images: Regenerate Thumbnails, Image Siz…
- CVE-2025-9462WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parametertobias_conrad WP2LEADS | WordPress und KlickTipp einfach v…
- CVE-2026-103962User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameterwedevs User Frontend – Membership, User Registration, User…
- CVE-2026-116535SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template…rainbowgeek SEOPress – AI SEO Plugin & On-site SEO
- CVE-2026-119096Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameteruncannyowl Uncanny Toolkit for LearnDash
- CVE-2026-118057Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Logpaultgoodchild Shield Security – Smart Bot Blocking, Brute-…
- CVE-2026-110023WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameterpeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-111592Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored…Co-Authors, Multiple Authors and Guest Authors in an Author…
- CVE-2026-104012Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking'…roxnor Rox Appointment Booking – Event, Calendar & Appointm…
- CVE-2026-11396Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via…woobewoo Product Filter for WooCommerce by WBW
- CVE-2026-109386Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via…wpmudev Hustle – Email Marketing, Lead Generation, Optins,…
- CVE-2026-119166Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]'…uscnanbu Welcart e-Commerce
- CVE-2026-119065Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameterarosoft Shipping Zones by Drawing for WooCommerce
- CVE-2026-109217PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice…wpovernight PDF Invoices & Packing Slips for WooCommerce
- CVE-2026-116548VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parametere4jvikwp VikRentCar Car Rental Management System
- CVE-2026-110251Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parametervillatheme Revopic – Photo Reviews for WooCommerce
- CVE-2026-116557WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note…murgroland WP Booking System – Booking Calendar
- CVE-2026-118070Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameteruscnanbu Welcart e-Commerce