CVEs
Browse the synced catalog, newest first.
- CVE-2026-120364WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityUntapwp Vidplex
- CVE-2026-119523WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2026-119525WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerabilityWP Desk Dropshipping XML for WooCommerce
- CVE-2026-120365WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerabilityAguila Technologies WP Customer Area
- CVE-2026-119478WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerabilityStylemixThemes MasterStudy LMS
- CVE-2026-119508WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerabilityMamunur Rashid Radius Booking — Booking Calendar for Appoin…
- CVE-2026-119492WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerabilityMetaphor Creations Ditty
- CVE-2026-119501WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerabilityBdThemes Element Pack Elementor Addons
- CVE-2026-123961TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-121783WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerabilityPassionate Programmer Peter WP Data Access
- CVE-2026-119490WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerabilityMade with Fuel Better Notifications for WP
- CVE-2026-119486WordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerabilityWP ManageNinja FluentBoards
- CVE-2026-119500WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins Flash & HTML5 Video
- CVE-2026-120840WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerabilityThemeGrill User Registration
- CVE-2026-120842WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerabilityBrainstorm Force SureForms
- CVE-2026-119520WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerabilityBrainstorm Force Spectra
- CVE-2026-119494WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerabilityGemini Labs Site Reviews
- CVE-2026-120850WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerabilityElementor Website Builder
- CVE-2026-119493WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerabilityMetaphor Creations Ditty
- CVE-2026-123960TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflowTOTOLINK CA300-PoE
- CVE-2026-123959TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflowTOTOLINK CA300-PoE
- CVE-2026-119507WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerabilityWPDeveloper NotificationX
- CVE-2026-119473WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerabilityproperfraction ProfilePress
- CVE-2026-119465WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerabilityWPVibes Elementor Addon Elements
- CVE-2026-121762WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerabilityBlubrry Podcasting PowerPress Podcasting
- CVE-2026-107616Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure…melograno Booking for Appointments and Events Calendar – Am…
- CVE-2026-120532wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Formstomdever wpForo Forum
- CVE-2026-95870wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parametertomdever wpForo Forum
- CVE-2026-119164wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parametertomdever wpForo Forum
- CVE-2026-103900WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameterdenishua WPJAM Basic