# CVEs published 2026-04-04

57 CVEs were published on April 4, 2026: 3 critical, 19 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-5528](https://cve.now/CVE-2026-5528.md): MoussaabBadla code-screenshot-mcp HTTP os command injection (CVSS 5.3, MoussaabBadla code-screenshot-mcp)
- [CVE-2026-5527](https://cve.now/CVE-2026-5527.md): Tenda 4G03 Pro ECDSA P-256 Private Key server.key hard-coded key (CVSS 6.9, Tenda 4G03 Pro)
- [CVE-2026-5526](https://cve.now/CVE-2026-5526.md): Tenda 4G03 Pro httpd access control (CVSS 6.9, Tenda 4G03 Pro)
- [CVE-2018-25246](https://cve.now/CVE-2018-25246.md): Wikipedia 12.0 Denial of Service via Search (CVSS 8.7, Wikipedia)
- [CVE-2016-20054](https://cve.now/CVE-2016-20054.md): Nodcms Cross Site Request Forgery via admin endpoints (CVSS 5.3, nodCMS · khodakhah/nodcms)
- [CVE-2018-25255](https://cve.now/CVE-2018-25255.md): 10-Strike LANState 8.8 Local Buffer Overflow SEH (CVSS 8.6, 10-Strike Strike LANState)
- [CVE-2018-25254](https://cve.now/CVE-2018-25254.md): NICO-FTP 3.0.1.19 Buffer Overflow SEH (CVSS 9.3, NICO-FTP)
- [CVE-2018-25253](https://cve.now/CVE-2018-25253.md): Termite 3.4 Denial of Service via Settings Buffer Overflow (CVSS 6.9, Compuphase Termite)
- [CVE-2018-25252](https://cve.now/CVE-2018-25252.md): FTP Voyager 16.2.0 Denial of Service via Malformed Site Profile (CVSS 6.9, Serv-U FTP Voyager)
- [CVE-2018-25251](https://cve.now/CVE-2018-25251.md): Snes9K 0.0.9z Buffer Overflow SEH via Netplay Socket (CVSS 8.6, Sourceforge Snes9K)
- [CVE-2018-25250](https://cve.now/CVE-2018-25250.md): MyBB Last User's Threads in Profile Plugin 1.2 Persistent XSS (CVSS 5.1, MyBB Last User's Threads in Profile Plugin)
- [CVE-2018-25249](https://cve.now/CVE-2018-25249.md): MyBB My Arcade Plugin 1.3 Persistent XSS via Comment (CVSS 5.1, MyBB My Arcade Plugin)
- [CVE-2018-25248](https://cve.now/CVE-2018-25248.md): MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php (CVSS 5.1, MyBB Downloads Plugin)
- [CVE-2018-25247](https://cve.now/CVE-2018-25247.md): MyBB Like Plugin 3.0.0 Cross-Site Scripting via User Profiles (CVSS 5.1, MyBB Like Plugin)
- [CVE-2018-25245](https://cve.now/CVE-2018-25245.md): 7 Tik 1.0.1.0 Denial of Service via Search (CVSS 8.7, 7Tik 7 Tik)
- [CVE-2018-25244](https://cve.now/CVE-2018-25244.md): Eco Search 1.0.2.0 Denial of Service (CVSS 6.9, EcoSearch Eco Search)
- [CVE-2018-25243](https://cve.now/CVE-2018-25243.md): FastTube 1.0.1.0 Denial of Service via Search (CVSS 6.9, FastTube)
- [CVE-2018-25242](https://cve.now/CVE-2018-25242.md): One Search 1.1.0.0 Denial of Service (CVSS 6.9, OneSearch One Search)
- [CVE-2018-25241](https://cve.now/CVE-2018-25241.md): VPN Browser+ 1.1.0.0 Denial of Service (CVSS 8.7, VPNBrowser VPN Browser+)
- [CVE-2018-25240](https://cve.now/CVE-2018-25240.md): Watchr 1.1.0.0 Denial of Service via Search (CVSS 6.9, Watchr)
- [CVE-2018-25239](https://cve.now/CVE-2018-25239.md): Smart VPN 1.1.3.0 Denial of Service via Search (CVSS 6.9, SmartVPN Smart VPN)
- [CVE-2018-25238](https://cve.now/CVE-2018-25238.md): VSCO 1.1.1.0 Denial of Service via Search (CVSS 6.9, VSCO)
- [CVE-2016-20061](https://cve.now/CVE-2016-20061.md): sheed AntiVirus 2.3 Unquoted Service Path Privilege Escalation (CVSS 8.5, Sheedantivirus sheed AntiVirus)
- [CVE-2016-20060](https://cve.now/CVE-2016-20060.md): Hotspot Shield 6.0.3 Unquoted Service Path Privilege Escalation (CVSS 8.5, Hotspotshield Hotspot Shield)
- [CVE-2016-20059](https://cve.now/CVE-2016-20059.md): IObit Malware Fighter 4.3.1 Unquoted Service Path Privilege Escalation (CVSS 8.5, IObit Malware Fighter)
- [CVE-2016-20058](https://cve.now/CVE-2016-20058.md): Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation (CVSS 8.5, NETGATE AMITI Antivirus)
- [CVE-2016-20057](https://cve.now/CVE-2016-20057.md): NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation (CVSS 8.5, NETGATE Registry Cleaner)
- [CVE-2016-20056](https://cve.now/CVE-2016-20056.md): Spy Emergency build 23.0.205 Unquoted Service Path Privilege Escalation (CVSS 8.5, Spy-Emergency Spy Emergency)
- [CVE-2016-20055](https://cve.now/CVE-2016-20055.md): IObit Advanced SystemCare 10.0.2 Unquoted Service Path Privilege Escalation (CVSS 8.5, IObit Advanced SystemCare)
- [CVE-2016-20053](https://cve.now/CVE-2016-20053.md): Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint (CVSS 6.9, Redaxo CMS)
- [CVE-2016-20052](https://cve.now/CVE-2016-20052.md): Snews CMS 1.7 Unrestricted File Upload via snews\_files (CVSS 9.3, Snewscms Snews CMS upload sheller)
- [CVE-2016-20051](https://cve.now/CVE-2016-20051.md): Snews CMS 1.7 Cross-Site Request Forgery via changeup (CVSS 6.9, Snewscms Snews CMS Cross Site Request Forgery)
- [CVE-2016-20050](https://cve.now/CVE-2016-20050.md): NetSchedScan 1.0 Buffer Overflow Denial of Service (CVSS 6.9, Foundstone NetSchedScan)
- [CVE-2026-3666](https://cve.now/CVE-2026-3666.md): wpForo Forum \<= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body (CVSS 8.8, tomdever wpForo Forum)
- [CVE-2026-2936](https://cve.now/CVE-2026-2936.md): Visitor Traffic Real Time Statistics \<= 8.4 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, wp-buy Visitor Traffic Real Time Statistics)
- [CVE-2026-1233](https://cve.now/CVE-2026-1233.md): Text to Speech (TTS) by Mementor \<= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access (CVSS 7.5, mvirik Text to Speech – TTSWP)
- [CVE-2025-14938](https://cve.now/CVE-2025-14938.md): Listeo-Core - Directory Plugin by Purethemes \<= 2.0.27 - Unauthenticated Arbitrary Media Upload (CVSS 5.3, Listeo-Core - Directory Plugin by Purethemes)
- [CVE-2026-3309](https://cve.now/CVE-2026-3309.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields (CVSS 6.5, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-0626](https://cve.now/CVE-2026-0626.md): WPFunnels \<= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf\_optin\_form' Shortcode (CVSS 6.4, getwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…)
- [CVE-2026-3445](https://cve.now/CVE-2026-3445.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass (CVSS 7.1, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2026-2826](https://cve.now/CVE-2026-2826.md): Kadence Blocks — Page Builder Toolkit for Gutenberg Editor \<= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload (CVSS 4.3, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-2437](https://cve.now/CVE-2026-2437.md): WP Travel Engine - Travel and Tour Booking Plugin \<= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte\_trip\_tax Shortcode (CVSS 6.4, wptravelengine WP Travel Engine – Tour Booking Plugin – Tou…)
- [CVE-2026-5425](https://cve.now/CVE-2026-5425.md): Widgets for Social Photo Feed \<= 1.7.9 - Unauthenticated Stored Cross-Site Scripting via feed\_data (CVSS 7.2, trustindex Widgets for Social Photo Feed)
- [CVE-2026-4896](https://cve.now/CVE-2026-4896.md): WCFM - WooCommerce Frontend Manager \<= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Product Manipulation (CVSS 8.1, wclovers WCFM – Frontend Manager for WooCommerce)
- [CVE-2025-13368](https://cve.now/CVE-2025-13368.md): Xpro Addons — 140+ Widgets for Elementor \<= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2026-0552](https://cve.now/CVE-2026-0552.md): Simple Shopping Cart \<= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc\_display\_product' Shortcode (CVSS 6.4, mra13 Simple Shopping Cart)
- [CVE-2026-0737](https://cve.now/CVE-2026-0737.md): Shortcodes Ultimate \<= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su\_lightbox' Shortcode (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2026-0738](https://cve.now/CVE-2026-0738.md): Shortcodes Ultimate \<= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su\_carousel' Shortcode (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2026-2600](https://cve.now/CVE-2026-2600.md): ElementsKit Elementor Addons and Templates \<= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2026-0664](https://cve.now/CVE-2026-0664.md): Royal Elementor Addons \<= 1.7.1049 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass (CVSS 6.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2025-15064](https://cve.now/CVE-2025-15064.md): Ultimate Member \<= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets (CVSS 6.4, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-2949](https://cve.now/CVE-2026-2949.md): Xpro Addons — 140+ Widgets for Elementor \<= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget (CVSS 6.4, Xpro Addons — 140+ Widgets for Elementor)
- [CVE-2026-2924](https://cve.now/CVE-2026-2924.md): Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem \<= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad' (CVSS 6.4, jegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons…)
- [CVE-2026-3571](https://cve.now/CVE-2026-3571.md): Pie Register – User Registration, Profiles & Content Restriction \<= 3.8.4.8 - Missing Authorization to Unauthenticated Registration Form Status Modification (CVSS 6.5, genetechproducts Pie Register – User Registration, Profiles…)
- [CVE-2026-35616](https://cve.now/CVE-2026-35616.md): A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unau (CVSS 9.1, KEV, Fortinet FortiClientEMS)
- [CVE-2026-34780](https://cve.now/CVE-2026-34780.md): Electron: Context Isolation bypass via contextBridge VideoFrame transfer (CVSS 8.4, electron)
- [CVE-2026-34779](https://cve.now/CVE-2026-34779.md): Electron: AppleScript injection in app.moveToApplicationsFolder on macOS (CVSS 6.5, electron)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-04-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.