CVEs
Browse the synced catalog, newest first.
- CVE-2026-123183WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerabilityPluginUs.Net Active Products Tables for WooCommerce
- CVE-2026-123474WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerabilityLeapWorx Premium Blocks – Gutenberg Blocks for WordPress
- CVE-2026-121775WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerabilityVillaTheme CURCY
- CVE-2026-123462WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerabilitymyCred
- CVE-2026-122669WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityEverest Forms
- CVE-2026-122663WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerabilityVillaTheme CURCY
- CVE-2026-121784WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityMagepeople WpBookingly
- CVE-2026-123477WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetEngine
- CVE-2026-123963OpenBMB Internet of Agents Agent Registry app.py register missing authenticationOpenBMB Internet of Agents
- CVE-2026-120579Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via…realmag777 Active Woot Products Tables for WooCommerce. 100…
- CVE-2026-109973Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameteroxilab Flipbox – Awesomes Flip Boxes Image Overlay
- CVE-2026-122041Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via…Themehigh Checkout Field Editor for WooCommerce
- CVE-2026-119156Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template…codename065 Download Manager
- RUSTSEC-2026-0503eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windowseazip
- CVE-2026-119498WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerabilityRelyWP Simple Cloudflare Turnstile
- CVE-2026-121765WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs TranslatePress
- CVE-2026-123776RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks…RRD-CGI-Image
- CVE-2026-93429VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parametere4jvikwp VikBooking Hotel Booking Engine & PMS
- CVE-2026-121977JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Propertyjetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-120509Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parametershapedplugin Real Testimonials – Testimonial Slider, Collec…
- CVE-2026-115548Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent HeaderQuttera ThreatSign – Web Malware Scanner for WordPress
- CVE-2026-111317JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Sourcejetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-109214User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Inputwedevs User Frontend – Membership, User Registration, User…
- CVE-2026-111370WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker…osamaesh WP Visitor Statistics
- CVE-2026-109991FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information…teamfunnelkit FunnelKit Payment Gateway for Stripe WooComme…
- CVE-2026-104014Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password…naimurrahmannahid Naimur Email OTP Verification for WooComm…
- CVE-2026-118050Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Messageantoineh Football Pool
- CVE-2026-118267WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update…peterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2026-123418Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameterandy_moyle Church Admin
- CVE-2026-121976Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameterwpchill Modula Image Gallery – Photo Grid & Video Gallery