CVEs published April 4, 2026
57 CVEs were published on April 4, 2026: 3 critical, 19 high. 1 is now in CISA KEV.
- Published
- 57
- Critical
- 3
- High
- 19
- Medium
- 35
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- electron
- 2
- gn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- 2
- properfraction Paid Membership Plugin, Ecommerce, User Regi…
- 2
- Tenda 4G03 Pro
- 2
- Xpro Addons — 140+ Widgets for Elementor
- 2
- 10-Strike Strike LANState
- 1
- 7Tik 7 Tik
- 1
- Compuphase Termite
- 1
- EcoSearch Eco Search
- 1
- FastTube
- 1
Critical 3
- CVE-2018-25254NICO-FTP 3.0.1.19 Buffer Overflow SEHNICO-FTP
- CVE-2016-20052Snews CMS 1.7 Unrestricted File Upload via snews_filesSnewscms Snews CMS upload sheller
- CVE-2026-35616A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauFortinet FortiClientEMS
High 19
- CVE-2018-25246Wikipedia 12.0 Denial of Service via SearchWikipedia
- CVE-2018-2525510-Strike LANState 8.8 Local Buffer Overflow SEH10-Strike Strike LANState
- CVE-2018-25251Snes9K 0.0.9z Buffer Overflow SEH via Netplay SocketSourceforge Snes9K
- CVE-2018-252457 Tik 1.0.1.0 Denial of Service via Search7Tik 7 Tik
- CVE-2018-25241VPN Browser+ 1.1.0.0 Denial of ServiceVPNBrowser VPN Browser+
- CVE-2016-20061sheed AntiVirus 2.3 Unquoted Service Path Privilege EscalationSheedantivirus sheed AntiVirus
- CVE-2016-20060Hotspot Shield 6.0.3 Unquoted Service Path Privilege EscalationHotspotshield Hotspot Shield
- CVE-2016-20059IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege EscalationIObit Malware Fighter
- CVE-2016-20058Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege EscalationNETGATE AMITI Antivirus
- CVE-2016-20057NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege EscalationNETGATE Registry Cleaner
- CVE-2016-20056Spy Emergency build 23.0.205 Unquoted Service Path Privilege EscalationSpy-Emergency Spy Emergency
- CVE-2016-20055IObit Advanced SystemCare 10.0.2 Unquoted Service Path Privilege EscalationIObit Advanced SystemCare
- CVE-2026-3666wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Bodytomdever wpForo Forum
- CVE-2026-2936Visitor Traffic Real Time Statistics <= 8.4 - Unauthenticated Stored Cross-Site Scriptingwp-buy Visitor Traffic Real Time Statistics
- CVE-2026-1233Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Accessmvirik Text to Speech – TTSWP
- CVE-2026-3445Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypassproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2026-5425Widgets for Social Photo Feed <= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed_datatrustindex Widgets for Social Photo Feed
- CVE-2026-4896WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulationwclovers WCFM – Frontend Manager for WooCommerce
- CVE-2026-34780Electron: Context Isolation bypass via contextBridge VideoFrame transferelectron
Medium, low and unrated 35
- CVE-2026-5528MoussaabBadla code-screenshot-mcp HTTP os command injectionMoussaabBadla code-screenshot-mcp
- CVE-2026-5527Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded keyTenda 4G03 Pro
- CVE-2026-5526Tenda 4G03 Pro httpd access controlTenda 4G03 Pro
- CVE-2016-20054Nodcms Cross Site Request Forgery via admin endpointsnodCMS · khodakhah/nodcms
- CVE-2018-25253Termite 3.4 Denial of Service via Settings Buffer OverflowCompuphase Termite
- CVE-2018-25252FTP Voyager 16.2.0 Denial of Service via Malformed Site ProfileServ-U FTP Voyager
- CVE-2018-25250MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSSMyBB Last User's Threads in Profile Plugin
- CVE-2018-25249MyBB My Arcade Plugin 1.3 Persistent XSS via CommentMyBB My Arcade Plugin
- CVE-2018-25248MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.phpMyBB Downloads Plugin
- CVE-2018-25247MyBB Like Plugin 3.0.0 Cross-Site Scripting via User ProfilesMyBB Like Plugin
- CVE-2018-25244Eco Search 1.0.2.0 Denial of ServiceEcoSearch Eco Search
- CVE-2018-25243FastTube 1.0.1.0 Denial of Service via SearchFastTube
- CVE-2018-25242One Search 1.1.0.0 Denial of ServiceOneSearch One Search
- CVE-2018-25240Watchr 1.1.0.0 Denial of Service via SearchWatchr
- CVE-2018-25239Smart VPN 1.1.3.0 Denial of Service via SearchSmartVPN Smart VPN
- CVE-2018-25238VSCO 1.1.1.0 Denial of Service via SearchVSCO
- CVE-2016-20053Redaxo CMS 5.2 Cross-Site Request Forgery via users endpointRedaxo CMS
- CVE-2016-20051Snews CMS 1.7 Cross-Site Request Forgery via changeupSnewscms Snews CMS Cross Site Request Forgery
- CVE-2016-20050NetSchedScan 1.0 Buffer Overflow Denial of ServiceFoundstone NetSchedScan
- CVE-2025-14938Listeo-Core - Directory Plugin by Purethemes <= 2.0.27 - Unauthenticated Arbitrary Media UploadListeo-Core - Directory Plugin by Purethemes
- CVE-2026-3309Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fieldsproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2026-0626WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcodegetwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…
- CVE-2026-2826Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Uploadstellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2026-2437WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcodewptravelengine WP Travel Engine – Tour Booking Plugin – Tou…
- CVE-2025-13368Xpro Addons — 140+ Widgets for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site ScriptingXpro Addons — 140+ Widgets for Elementor
- CVE-2026-0552Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcodemra13 Simple Shopping Cart
- CVE-2026-0737Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcodegn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2026-0738Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcodegn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2026-2600ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widgetroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2026-0664Royal Elementor Addons <= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypasswproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2025-15064Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgetsultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-2949Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box WidgetXpro Addons — 140+ Widgets for Elementor
- CVE-2026-2924Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad'jegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons…
- CVE-2026-3571Pie Register – User Registration, Profiles & Content Restriction <= 3.8.4.8 - Missing Authorization to Unauthenticated Registration Form Status Modificationgenetechproducts Pie Register – User Registration, Profiles…
- CVE-2026-34779Electron: AppleScript injection in app.moveToApplicationsFolder on macOSelectron