CVEs
Browse the synced catalog, newest first.
- CVE-2026-122675WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerabilityWpmet Wp Social
- CVE-2026-121761WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerabilityInfomaniak Network VOD Infomaniak
- CVE-2026-121767WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerabilityweDevs weDocs
- CVE-2026-121778WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerabilityWP Lab WP-Lister Lite for Amazon
- CVE-2026-121779WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerabilityYITH WooCommerce Subscription
- CVE-2026-39733WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerabilityproperfraction ProfilePress
- CVE-2026-104738Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parametersnasirahmed Advanced Form Integration — Connect Forms to 300…
- CVE-2026-123957TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflowTOTOLINK CA300-PoE
- CVE-2026-123881OpenBMB Internet of Agents Message app.py fetch_chat_record access controlOpenBMB Internet of Agents
- CVE-2026-118800aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attributekodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…
- CVE-2026-120537TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpointcozmoslabs TranslatePress – Translate Multilingual sites wi…
- CVE-2026-115811Strong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameterwpchill Strong Testimonials
- CVE-2026-118801aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcodekodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…
- CVE-2026-121792GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameterrubengc GamiPress – Gamification plugin to reward points, b…
- CVE-2026-120530WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile BiographyWebToffee WP Backup and Migration
- CVE-2026-120479WP Data Access <= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project…peterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-122265Vanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parametervanquish83 Vanquish Upload Files for WooCommerce
- CVE-2026-122037AgenWebsite Shipping <= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup WizardAgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi…
- CVE-2026-87112QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parametersquarka QA Assistants – Driven by data
- CVE-2026-118204WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Rendererpeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-121536WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameterpeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-93370Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay EndpointPaystack WooCommerce Payment Gateway
- CVE-2026-116621Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Fieldultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-118048WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Labelpeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-120515SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and…rainbowgeek SEOPress – AI SEO Plugin & On-site SEO
- CVE-2026-116558Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widgetunitecms Unlimited Elements for Elementor
- CVE-2026-103917Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameterexpresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…
- CVE-2026-83495Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltrationRed Hat OpenShift AI
- CVE-2026-122001Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRFKomfortkasse for WooCommerce
- CVE-2026-121866Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option UpdateiLeads SMS Gateway by Exsile