CVEs
Browse the synced catalog, newest first.
- CVE-2026-120560Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id'…realmag777 Active Woot Products Tables for WooCommerce. 100…
- CVE-2026-120739Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset DescriptorOptimole – Optimize Images | Convert WebP & AVIF | CDN & La…
- CVE-2026-19803Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' ParameterPrintcart Store – Web to Print Product Designer for WooComm…
- CVE-2026-17362Multiple Vulnerabilities in IBM API ConnectIBM API Connect
- CVE-2026-120540iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment…iubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…
- CVE-2026-119218Greenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute…wpsoul Greenshift – animation and page builder blocks
- CVE-2026-120741MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpointjetmonsters MotoPress Appointment Booking
- CVE-2026-115816Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Reviewextendthemes Kubio AI Page Builder
- CVE-2026-119175Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment…gijo Flying Images: Optimize and Lazy Load Images for Faste…
- CVE-2026-121515FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Contentfoliovision FV Flowplayer Video Player
- CVE-2026-104913Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.jsonesaia Interactive Real Estate – Floor Plan & Building Visua…
- CVE-2026-118067Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields ParameterForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-119165WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display NameWPBakery Page Builder
- CVE-2026-119152Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email FieldAppointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-119213Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feedwpmanageninja Fluent Support – Helpdesk & Customer Support…
- CVE-2026-119098LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question AnswerLifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- CVE-2026-120555Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameterartbees Jupiter X Core
- CVE-2026-119616Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_namepicocodes Noptin – Newsletter, New Post Notifications & Ema…
- CVE-2026-121519Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameterthemeisle Social Slider Feed – Social Media Feed & Gallery…
- CVE-2026-120737Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameterartbees Jupiter X Core
- CVE-2026-120082GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_contentpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-120520Greenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameterwpsoul Greenshift – animation and page builder blocks
- CVE-2026-119219Jupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Metaartbees Jupiter X Core
- CVE-2026-118046JS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox…rabilal JS Help Desk – AI-Powered Support & Ticketing System
- CVE-2026-119070Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL ReplacerOptimole – Optimize Images | Convert WebP & AVIF | CDN & La…
- CVE-2026-118054LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameterthimpress LearnPress – Course Review
- CVE-2026-116562Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameterstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-93754payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Executionpayever Checkout – Composable Payment Gateway
- CVE-2026-120512Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field ValueForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-71881Cross-site scripting in Integrated Publishing ToolkitGBIF Integrated Publishing Toolkit