# CVEs published 2026-01-24

65 CVEs were published on January 24, 2026: 7 critical, 14 high. Days are UTC.

- [CVE-2026-0593](https://cve.now/CVE-2026-0593.md): WP Go Maps (formerly WP Google Maps) \<= 10.0.04 - Missing Authorization to Authenticated (Subscriber+) Map Engine Setting Modification (CVSS 5.3, wpgmaps WP Go Maps)
- [CVE-2026-0862](https://cve.now/CVE-2026-0862.md): Save as PDF Plugin by PDFCrowd \<= 4.5.5 - Reflected Cross-Site Scripting via options (CVSS 6.1, Save as PDF Plugin by PDFCrowd)
- [CVE-2025-13920](https://cve.now/CVE-2025-13920.md): WP Directory Kit \<= 1.4.9 - Unauthenticated Email Exposure via wdk\_public\_action (CVSS 5.3, wpdirectorykit WP Directory Kit)
- [CVE-2026-0911](https://cve.now/CVE-2026-0911.md): Hustle \<= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import (CVSS 7.5, wpmudev Hustle – Email Marketing, Lead Generation, Optins,…)
- [CVE-2025-13205](https://cve.now/CVE-2025-13205.md): SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity \<= 2.5.2 - Cross-Site Request Forgery to Survey Cloning (CVSS 4.3, devsoftbaltic SurveyJS: Drag & Drop Form Builder)
- [CVE-2026-1127](https://cve.now/CVE-2026-1127.md): Timeline Event History \<= 3.2 - Reflected Cross-Site Scripting (CVSS 6.1, wpdiscover Timeline Event History)
- [CVE-2025-13194](https://cve.now/CVE-2025-13194.md): SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity \<= 2.5.2 - Cross-Site Request Forgery to Survey Renaming (CVSS 4.3, devsoftbaltic SurveyJS: Drag & Drop Form Builder)
- [CVE-2026-1191](https://cve.now/CVE-2026-1191.md): JavaScript Notifier \<= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, freemp JavaScript Notifier)
- [CVE-2026-1208](https://cve.now/CVE-2026-1208.md): Friendly Functions for Welcart \<= 1.2.5 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, mainichiweb Friendly Functions for Welcart)
- [CVE-2026-1189](https://cve.now/CVE-2026-1189.md): LeadBI Plugin for WordPress \<= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form\_id' Shortcode Attribute (CVSS 6.4, LeadBI Plugin for WordPress)
- [CVE-2026-1300](https://cve.now/CVE-2026-1300.md): Responsive Header Plugin \<= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters (CVSS 4.4, mehtevas Responsive Header Plugin)
- [CVE-2025-13139](https://cve.now/CVE-2025-13139.md): SurveyJS: Drag & Drop WordPress Form Builder \<= 2.5.2 - Cross-Site Request Forgery to Survey Creation (CVSS 4.3, devsoftbaltic SurveyJS: Drag & Drop Form Builder)
- [CVE-2026-1098](https://cve.now/CVE-2026-1098.md): CM CSS Columns \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute (CVSS 6.4, codemacher CM CSS Columns)
- [CVE-2026-0633](https://cve.now/CVE-2026-0633.md): MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor \<= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value (CVSS 3.7, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2026-1302](https://cve.now/CVE-2026-1302.md): Meta-box GalleryMeta \<= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption (CVSS 4.4, shahinurislam Meta-box GalleryMeta)
- [CVE-2025-14630](https://cve.now/CVE-2025-14630.md): AdminQuickbar \<= 1.9.3 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, rtowebsites AdminQuickbar)
- [CVE-2026-0687](https://cve.now/CVE-2026-0687.md): Meta-box GalleryMeta \<= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management (CVSS 4.3, shahinurislam Meta-box GalleryMeta)
- [CVE-2026-1266](https://cve.now/CVE-2026-1266.md): Postalicious \<= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, neop Postalicious)
- [CVE-2025-14907](https://cve.now/CVE-2025-14907.md): Moderate Selected Posts \<= 1.4 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, hallsofmontezuma Moderate Selected Posts)
- [CVE-2025-15516](https://cve.now/CVE-2025-15516.md): All-in-One Video Gallery 4.1.0 - 4.6.4 - Missing Authorization to Authenticated (Subscriber+) Limited User Meta Update (CVSS 4.3, plugins360 All-in-One Video Gallery)
- [CVE-2026-0800](https://cve.now/CVE-2026-0800.md): User Submitted Posts – Enable Users to Submit Posts from the Front End \<= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field (CVSS 7.2, specialk User Submitted Posts – Enable Users to Submit Post…)
- [CVE-2026-1088](https://cve.now/CVE-2026-1088.md): Login Page Editor \<= 1.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, zero1zerouk Login Page Editor)
- [CVE-2025-13676](https://cve.now/CVE-2025-13676.md): JustClick registration plugin \<= 0.1 - Reflected Cross-Site Scripting via PHP\_SELF (CVSS 6.1, ostin654 JustClick registration plugin)
- [CVE-2026-1099](https://cve.now/CVE-2026-1099.md): Administrative Shortcodes \<= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes (CVSS 6.4, shazdeh Administrative Shortcodes)
- [CVE-2025-14609](https://cve.now/CVE-2025-14609.md): Wise Analytics \<= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' Parameter (CVSS 5.3, marcinlawrowski Wise Analytics)
- [CVE-2026-1097](https://cve.now/CVE-2026-1097.md): ThemeRuby Multi Authors \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes (CVSS 6.4, ThemeRuby Multi Authors – Assign Multiple Writers to Posts)
- [CVE-2025-14941](https://cve.now/CVE-2025-14941.md): GZSEO \<= 2.0.11 - Authenticated (Contributor+) Authorization Bypass to Stored Cross-Site Scripting (CVSS 6.4, aminhashemy GZSEO)
- [CVE-2026-1084](https://cve.now/CVE-2026-1084.md): Cookie consent for developers \<= 1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Multiple Settings Fields (CVSS 4.4, lovor Cookie consent for developers)
- [CVE-2025-14843](https://cve.now/CVE-2025-14843.md): Wizit Gateway for WooCommerce \<= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation (CVSS 5.3, Wizit Gateway for WooCommerce)
- [CVE-2026-1075](https://cve.now/CVE-2026-1075.md): ZT Captcha \<= 1.0.4 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, teamzt ZT Captcha)
- [CVE-2026-1081](https://cve.now/CVE-2026-1081.md): Set Bulk Post Categories \<= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update (CVSS 4.3, sauravrox Set Bulk Post Categories)
- [CVE-2025-14629](https://cve.now/CVE-2025-14629.md): Alchemist Ajax Upload \<= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion (CVSS 5.3, tandubhai Alchemist Ajax Upload)
- [CVE-2026-1103](https://cve.now/CVE-2026-1103.md): AIKTP \<= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions (CVSS 5.4, AIKTP)
- [CVE-2025-14985](https://cve.now/CVE-2025-14985.md): Alpha Blocks \<= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alpha\_block\_css' Post Meta (CVSS 6.4, robiulawal40 Alpha Blocks)
- [CVE-2025-14797](https://cve.now/CVE-2025-14797.md): Same Category Posts \<= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via Widget Title Placeholder (CVSS 5.4, kometschuh Same Category Posts)
- [CVE-2026-1095](https://cve.now/CVE-2026-1095.md): Canto Testimonials \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute (CVSS 6.4, cantothemes Canto Testimonials)
- [CVE-2026-0806](https://cve.now/CVE-2026-0806.md): WP-ClanWars \<= 2.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9, andddd WP-ClanWars)
- [CVE-2025-13374](https://cve.now/CVE-2025-13374.md): Kalrav AI Agent \<= 2.3.3 - Unauthenticated Arbitrary File Upload via kalrav\_upload\_file AJAX Action (CVSS 9.8, irisideatechsolutions Kalrav AI Agent)
- [CVE-2026-1076](https://cve.now/CVE-2026-1076.md): Star Review Manager \<= 1.2.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, bramdnl Star Review Manager)
- [CVE-2025-14906](https://cve.now/CVE-2025-14906.md): WP Youtube Video Gallery \<= 1.0 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, waqasvickey0071 WP Youtube Video Gallery)
- [CVE-2025-12836](https://cve.now/CVE-2025-12836.md): VK Google Job Posting Manager \<= 1.2.23 - Authenticated (Author+) Stored Cross-Site Scripting via Job Description Field (CVSS 6.4, vektor-inc VK Google Job Posting Manager)
- [CVE-2026-0807](https://cve.now/CVE-2026-0807.md): Frontis Blocks \<= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter (CVSS 7.2, wpmessiah Frontis Blocks — Block Library for the Block Edit…)
- [CVE-2026-1070](https://cve.now/CVE-2026-1070.md): Alex User Counter \<= 6.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, adzbierajewski Alex User Counter)
- [CVE-2025-14903](https://cve.now/CVE-2025-14903.md): Simple Crypto Shortcodes \<= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, stefanristic Simple Crypto Shortcodes)
- [CVE-2026-1257](https://cve.now/CVE-2026-1257.md): Administrative Shortcodes \<= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute (CVSS 7.5, shazdeh Administrative Shortcodes)
- [CVE-2025-13952](https://cve.now/CVE-2025-13952.md): GPU DDK - libusc UAF via WebGPU shaders at MergeConsecutiveBarriersBP (CVSS 9.8, Imagination Technologies Graphics DDK)
- [CVE-2026-24422](https://cve.now/CVE-2026-24422.md): phpMyFAQ: Public API endpoints expose emails and invisible questions (CVSS 5.3, thorsten phpMyFAQ · phpmyfaq/phpmyfaq +1)
- [CVE-2026-24420](https://cve.now/CVE-2026-24420.md): phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) (CVSS 6.5, thorsten phpMyFAQ · phpmyfaq/phpmyfaq +1)
- [CVE-2026-24469](https://cve.now/CVE-2026-24469.md): C++ HTTP Server has Critical Path Traversal Vulnerability in RequestHandler Allowing Arbitrary File Read (CVSS 7.5, frustratedProton http-server)
- [CVE-2026-24421](https://cve.now/CVE-2026-24421.md): phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user (CVSS 6.5, thorsten phpMyFAQ · phpmyfaq/phpmyfaq +1)
- [CVE-2026-24412](https://cve.now/CVE-2026-24412.md): iccDEV has Heap Buffer Overflow in icCurvesFromXml() (CVSS 8.8, InternationalColorConsortium iccDEV)
- [CVE-2026-24401](https://cve.now/CVE-2026-24401.md): Avahi has Uncontrolled Recursion in lookup\_handle\_cname function (CVSS 6.5, avahi)
- [CVE-2026-24411](https://cve.now/CVE-2026-24411.md): iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlSegmentedCurve::ToXml() (CVSS 7.1, InternationalColorConsortium iccDEV)
- [CVE-2026-24410](https://cve.now/CVE-2026-24410.md): iccDEV has Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic() (CVSS 7.1, InternationalColorConsortium iccDEV)
- [CVE-2026-24409](https://cve.now/CVE-2026-24409.md): iccDEV has Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum\<\>::ParseXml() (CVSS 7.1, InternationalColorConsortium iccDEV)
- [CVE-2026-24407](https://cve.now/CVE-2026-24407.md): iccDEV has Undefined Behavior in icSigCalcOp() (CVSS 7.1, InternationalColorConsortium iccDEV)
- [CVE-2026-24406](https://cve.now/CVE-2026-24406.md): iccDEV has Heap Buffer Overflow in CIccTagNamedColor2::SetSize() (CVSS 8.8, InternationalColorConsortium iccDEV)
- [CVE-2026-24405](https://cve.now/CVE-2026-24405.md): iccDEV has Heap Buffer Overflow in CIccMpeCalculator::Read() (CVSS 8.8, InternationalColorConsortium iccDEV)
- [CVE-2026-24404](https://cve.now/CVE-2026-24404.md): iccDEV has Null Pointer Deference and Undefined Behavior in CIccXmlArrayType() (CVSS 7.1, InternationalColorConsortium iccDEV)
- [CVE-2026-24403](https://cve.now/CVE-2026-24403.md): iccDEV Undefined Behavior in CIccProfile::CheckHeader() Leads to Integer Overflow (CVSS 7.1, InternationalColorConsortium iccDEV)
- [CVE-2026-22583](https://cve.now/CVE-2026-22583.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (C (CVSS 9.8, Salesforce Marketing Cloud Engagement)
- [CVE-2026-22582](https://cve.now/CVE-2026-22582.md): Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (M (CVSS 9.8, Salesforce Marketing Cloud Engagement)
- [CVE-2026-22586](https://cve.now/CVE-2026-22586.md): Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscr (CVSS 9.8, Salesforce Marketing Cloud Engagement)
- [CVE-2026-22585](https://cve.now/CVE-2026-22585.md): Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Pr (CVSS 9.8, Salesforce Marketing Cloud Engagement)
- [CVE-2026-24399](https://cve.now/CVE-2026-24399.md): ChatterMate has Stored Cross-Site Scripting (XSS) via Chatbot Input Execution (CVSS 9.3, chattermate.chat)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-01-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.