CVEs
Browse the synced catalog, newest first.
- CVE-2026-118784WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Namejohn-dagelmore WPSpeed – WordPress Speed, Cache & Performan…
- CVE-2026-104992Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure…melograno Booking for Appointments and Events Calendar – Am…
- CVE-2026-119155wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parametertomdever wpForo Forum
- CVE-2026-120548YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via…icopydoc YML for Yandex Market
- CVE-2026-110004wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parametertomdever wpForo Forum
- CVE-2026-120514Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameterdylanjkotze Zephyr Project Manager
- CVE-2026-123464WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-119502WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerabilityBdThemes Ultimate Store Kit Elementor Addons
- CVE-2026-122668WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred
- CVE-2026-120853WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerabilityBrainstorm Force CartFlows
- CVE-2026-120852WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerabilityBrainstorm Force CartFlows
- CVE-2026-123469WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-119491WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-61990WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerabilityWC Lovers WCFM Membership
- CVE-2026-119484WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerabilityPhoto Gallery by Supsystic
- CVE-2026-120847WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerabilityWpmet Metform
- CVE-2026-119511WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerabilitySaeed MC Woocommerce Wishlist
- CVE-2026-121766WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerabilityBlubrry Podcasting PowerPress Podcasting
- CVE-2026-123466WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerabilityLeapWorx Premium Blocks – Gutenberg Blocks for WordPress
- CVE-2026-121768WordPress Contact Form 7 – Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerabilityMarkus Wiesenhofer Contact Form 7 – Post Fields
- CVE-2026-52713WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerabilityThimPress LearnPress
- CVE-2026-119467WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerabilityWPVibes AnyWhere Elementor
- CVE-2026-66669WordPress Superb Addons: Blocks, Patterns & theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerabilitySuplugins Superb Addons: Blocks, Patterns & Theme Desig…
- CVE-2026-119510WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerabilitySaeed MC Woocommerce Wishlist
- CVE-2026-123958TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-121781WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerabilityWP ManageNinja Fluent Booking
- CVE-2026-119489WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerabilityBootstrapped Ventures WP Recipe Maker
- CVE-2026-120849WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerabilityWC Lovers WCFM Marketplace
- CVE-2026-120848WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerabilityWC Lovers WCFM Marketplace
- CVE-2026-124274WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred