CVEs published January 24, 2026
65 CVEs were published on January 24, 2026: 7 critical, 14 high.
- Published
- 65
- Critical
- 7
- High
- 14
- Medium
- 43
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- InternationalColorConsortium iccDEV
- 9
- Salesforce Marketing Cloud Engagement
- 4
- devsoftbaltic SurveyJS: Drag & Drop Form Builder
- 3
- thorsten phpMyFAQ · phpmyfaq/phpmyfaq +1
- 3
- shahinurislam Meta-box GalleryMeta
- 2
- shazdeh Administrative Shortcodes
- 2
- adzbierajewski Alex User Counter
- 1
- AIKTP
- 1
- aminhashemy GZSEO
- 1
- andddd WP-ClanWars
- 1
Critical 7
- CVE-2025-13374Kalrav AI Agent <= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Actionirisideatechsolutions Kalrav AI Agent
- CVE-2025-13952GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBPImagination Technologies Graphics DDK
- CVE-2026-22583Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CSalesforce Marketing Cloud Engagement
- CVE-2026-22582Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MSalesforce Marketing Cloud Engagement
- CVE-2026-22586Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, SubscrSalesforce Marketing Cloud Engagement
- CVE-2026-22585Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, PrSalesforce Marketing Cloud Engagement
- CVE-2026-24399ChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input Executionchattermate.chat
High 14
- CVE-2026-0911Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Importwpmudev Hustle – Email Marketing, Lead Generation, Optins,…
- CVE-2026-0800User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Fieldspecialk User Submitted Posts – Enable Users to Submit Post…
- CVE-2026-0807Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameterwpmessiah Frontis Blocks — Block Library for the Block Edit…
- CVE-2026-1257Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attributeshazdeh Administrative Shortcodes
- CVE-2026-24469C++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File ReadfrustratedProton http-server
- CVE-2026-24412iccDEV has Heap Buffer Overflow in icCurvesFromXml()InternationalColorConsortium iccDEV
- CVE-2026-24411iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlSegmentedCurve::ToXml()InternationalColorConsortium iccDEV
- CVE-2026-24410iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic()InternationalColorConsortium iccDEV
- CVE-2026-24409iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml()InternationalColorConsortium iccDEV
- CVE-2026-24407iccDEV has Undefined Behavior in icSigCalcOp()InternationalColorConsortium iccDEV
- CVE-2026-24406iccDEV has Heap Buffer Overflow in CIccTagNamedColor2::SetSize()InternationalColorConsortium iccDEV
- CVE-2026-24405iccDEV has Heap Buffer Overflow in CIccMpeCalculator::Read()InternationalColorConsortium iccDEV
- CVE-2026-24404iccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType()InternationalColorConsortium iccDEV
- CVE-2026-24403iccDEV Undefined Behavior in CIccProfile::CheckHeader() Leads to Integer OverflowInternationalColorConsortium iccDEV
Medium, low and unrated 44
- CVE-2026-0593WP Go Maps (formerly WP Google Maps) <= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modificationwpgmaps WP Go Maps
- CVE-2026-0862Save as PDF Plugin by PDFCrowd <= 4.5.5 - Reflected Cross-Site Scripting via optionsSave as PDF Plugin by PDFCrowd
- CVE-2025-13920WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_actionwpdirectorykit WP Directory Kit
- CVE-2025-13205SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloningdevsoftbaltic SurveyJS: Drag & Drop Form Builder
- CVE-2026-1127Timeline Event History <= 3.2 - Reflected Cross-Site Scriptingwpdiscover Timeline Event History
- CVE-2025-13194SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renamingdevsoftbaltic SurveyJS: Drag & Drop Form Builder
- CVE-2026-1191JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settingsfreemp JavaScript Notifier
- CVE-2026-1208Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Updatemainichiweb Friendly Functions for Welcart
- CVE-2026-1189LeadBI Plugin for WordPress <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode AttributeLeadBI Plugin for WordPress
- CVE-2026-1300Responsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parametersmehtevas Responsive Header Plugin
- CVE-2025-13139SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creationdevsoftbaltic SurveyJS: Drag & Drop Form Builder
- CVE-2026-1098CM CSS Columns <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attributecodemacher CM CSS Columns
- CVE-2026-0633MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Valueroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2026-1302Meta-box GalleryMeta <= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Captionshahinurislam Meta-box GalleryMeta
- CVE-2025-14630AdminQuickbar <= 1.9.3 - Cross-Site Request Forgery to Settings Updatertowebsites AdminQuickbar
- CVE-2026-0687Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Managementshahinurislam Meta-box GalleryMeta
- CVE-2026-1266Postalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settingsneop Postalicious
- CVE-2025-14907Moderate Selected Posts <= 1.4 - Cross-Site Request Forgery to Plugin Settings Updatehallsofmontezuma Moderate Selected Posts
- CVE-2025-15516All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Updateplugins360 All-in-One Video Gallery
- CVE-2026-1088Login Page Editor <= 1.2 - Cross-Site Request Forgery to Settings Updatezero1zerouk Login Page Editor
- CVE-2025-13676JustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELFostin654 JustClick registration plugin
- CVE-2026-1099Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributesshazdeh Administrative Shortcodes
- CVE-2025-14609Wise Analytics <= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' Parametermarcinlawrowski Wise Analytics
- CVE-2026-1097ThemeRuby Multi Authors <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode AttributesThemeRuby Multi Authors – Assign Multiple Writers to Posts
- CVE-2025-14941GZSEO <= 2.0.11 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scriptingaminhashemy GZSEO
- CVE-2026-1084Cookie consent for developers <= 1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Multiple Settings Fieldslovor Cookie consent for developers
- CVE-2025-14843Wizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order CancellationWizit Gateway for WooCommerce
- CVE-2026-1075ZT Captcha <= 1.0.4 - Cross-Site Request Forgery to Settings Updateteamzt ZT Captcha
- CVE-2026-1081Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Updatesauravrox Set Bulk Post Categories
- CVE-2025-14629Alchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletiontandubhai Alchemist Ajax Upload
- CVE-2026-1103AIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator ActionsAIKTP
- CVE-2025-14985Alpha Blocks <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alpha_block_css' Post Metarobiulawal40 Alpha Blocks
- CVE-2025-14797Same Category Posts <= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via Widget Title Placeholderkometschuh Same Category Posts
- CVE-2026-1095Canto Testimonials <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attributecantothemes Canto Testimonials
- CVE-2026-0806WP-ClanWars <= 2.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameterandddd WP-ClanWars
- CVE-2026-1076Star Review Manager <= 1.2.2 - Cross-Site Request Forgery to Settings Updatebramdnl Star Review Manager
- CVE-2025-14906WP Youtube Video Gallery <= 1.0 - Cross-Site Request Forgery to Plugin Settings Updatewaqasvickey0071 WP Youtube Video Gallery
- CVE-2025-12836VK Google Job Posting Manager <= 1.2.23 - Authenticated (Author+) Stored Cross-Site Scripting via Job Description Fieldvektor-inc VK Google Job Posting Manager
- CVE-2026-1070Alex User Counter <= 6.0 - Cross-Site Request Forgery to Settings Updateadzbierajewski Alex User Counter
- CVE-2025-14903Simple Crypto Shortcodes <= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Updatestefanristic Simple Crypto Shortcodes
- CVE-2026-24422phpMyFAQ: Public API endpoints expose emails and invisible questionsthorsten phpMyFAQ · phpmyfaq/phpmyfaq +1
- CVE-2026-24420phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)thorsten phpMyFAQ · phpmyfaq/phpmyfaq +1
- CVE-2026-24421phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated userthorsten phpMyFAQ · phpmyfaq/phpmyfaq +1
- CVE-2026-24401Avahi has Uncontrolled Recursion in lookup_handle_cname functionavahi