CVEs published October 10, 2026
411 CVEs were published on October 10, 2026: 77 critical, 143 high.
- Published
- 411
- Critical
- 77
- High
- 143
- Medium
- 178
- Low
- 13
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 33
Most affected products
- JeecgBoot
- 76
- ZTE Z80 Ultra
- 6
- Apache Software Foundation Apache DataSketches
- 4
- codename065 Download Manager
- 4
- Appointment Booking Plugin – LatePoint | Calendar & Schedul…
- 3
- Dmitry V. Barcode Scanner with Inventory & Order Manager
- 3
- ExtUtils-Typemaps-Default
- 3
- ladela Online Scheduling and Appointment Booking System – B…
- 3
- Rank Math SEO
- 3
- WPMU DEV Forminator
- 3
Critical 77
- CVE-2026-81797WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerabilityThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme
- CVE-2026-78535WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerabilityThemeRex Photolia
- CVE-2026-78533WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerabilityAncoraThemes Qwery
- CVE-2026-78531WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerabilityThemeREX Jacqueline
- CVE-2026-78529WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerabilityThemeREX Alliance
- CVE-2026-66569WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerabilityaxiomthemes Kicker
- CVE-2026-66568WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerabilityaxiomthemes Original
- CVE-2026-66567WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerabilityAncoraThemes Anesta
- CVE-2026-66565WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerabilityaxiomthemes FC United
- CVE-2026-66564WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerabilityThemeREX ShiftCV
- CVE-2026-66563WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerabilityThemeREX Windsor
- CVE-2026-66483WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerabilityThemeREX Education Center
- CVE-2026-66482WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerabilityAncoraThemes Drone Media
- CVE-2026-62129WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerabilityWPFunnels Creator LMS
- CVE-2026-62125WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerabilityThemeREX Asia Garden
- CVE-2026-62124WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerabilityThemeREX N7 | Golf Club Sports & Events
- CVE-2026-62123WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerabilityThemeREX Invetex
- CVE-2026-62120WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerabilityThemeREX Law Office
- CVE-2026-62090WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerabilityThemeREX WineShop
- CVE-2026-62087WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerabilityThemeREX Equadio
- CVE-2026-62086WordPress Juno theme <= 2.25 - PHP Object Injection vulnerabilityThemeREX Juno
- CVE-2026-62077WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerabilityBoldThemes Avala
- CVE-2026-62076WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerabilityThe4 Kalles
- CVE-2026-62054WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerabilityThemeREX Yacht Rental
- CVE-2026-62053WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerabilityThemeREX Wine House
- CVE-2026-62052WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerabilityThemeREX Tipsy
- CVE-2026-62051WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerabilityThemeREX Stargaze
- CVE-2026-62050WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerabilityThemeREX Splendour
- CVE-2026-62032WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerabilityDesigninvento DirectoryPress
- CVE-2026-62031WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerabilityStylemix uListing
- CVE-2026-62025WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerabilityTailored Media Tailored Tools
- CVE-2026-62024WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerabilityCodeBard Help Desk
- CVE-2026-62022WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerabilitySelect-Themes Tonda Membership
- CVE-2026-42723WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerabilityAncoraThemes CleanSkin
- CVE-2026-42719WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerabilitySarah Giles Dynamic User Directory
- CVE-2026-42718WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerabilityPluggabl Booster for WooCommerce
- CVE-2026-42716WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerabilityPayever - WooCommerce Gateway
- CVE-2026-42696WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerabilityRoyal Plugins SiteVault – Backup, Restore, Migration &…
- CVE-2026-40800WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerabilityELEXtensions ELEX WooCommerce Advanced Bulk Edit Products,…
- CVE-2026-39801WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerabilitySergey AIWU
- CVE-2026-108598Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templatesfloci-io floci
- CVE-2026-106610WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerabilityminiorange otp verification
- CVE-2026-105892WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerabilityrtCamp rtMedia for WordPress, BuddyPress and bbPress
- CVE-2026-104398WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerabilityVillaTheme AFFI – Affiliate Marketing for WooCommerce
- CVE-2026-105889WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerabilityTickera
- CVE-2026-108551openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templatesferdikoomen openapi-typescript-codegen
- CVE-2026-108549cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofingchenhg5 cc-connect
- CVE-2026-107373ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argumentExtUtils-Typemaps-Default
- CVE-2026-103635Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketchApache Software Foundation Apache DataSketches
- CVE-2026-103513Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketchApache Software Foundation Apache DataSketches
- CVE-2026-103501Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketchApache Software Foundation Apache DataSketches
- CVE-2026-104803WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callbackwhyun WPCOM Member
- CVE-2026-62045WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerabilityThemeREX Group Booklovers
- CVE-2026-62046WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerabilityThemeREX Group Gutentype
- CVE-2026-93945WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerabilityAxiomthemes Balance
- CVE-2026-93944WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerabilityThemeREX Group Camelia
- CVE-2026-93943WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerabilityThemeREX Group Convex
- CVE-2026-93942WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerabilityThemeREX Group Dwell
- CVE-2026-93941WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerabilityThemeREX Group Edema
- CVE-2026-93940WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerabilityThemeREX Group Greeny
- CVE-2026-93938WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerabilityThemeREX Group Hogwords
- CVE-2026-93937WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerabilityThemeREX Group Hygia
- CVE-2026-93936WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerabilityThemeREX Group IPharm
- CVE-2026-93935WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerabilityThemeREX Group Let's Play
- CVE-2026-93934WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerabilityThemeREX Group Partiso
- CVE-2026-93933WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerabilityThemeREX Group Rosalinda
- CVE-2026-93932WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerabilityThemeREX Group Smart Casa
- CVE-2026-93931WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerabilityThemeREX Group Smash
- CVE-2026-93930WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerabilityThemeREX Group Tantra
- CVE-2026-93929WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerabilityThemeREX Group Travesia
- CVE-2026-93927WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerabilityAxiomthemes Veto
- CVE-2026-104801PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameterthemeisle PPOM – Product Addons & Custom Fields for WooComm…
- CVE-2026-97670Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Fieldthemefusion Avada (Fusion) Builder
- CVE-2026-1038893D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameterexpivi 3D Product configurator for WooCommerce
- CVE-2026-94589Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Uploadhtplugins Extensions For CF7
- CVE-2026-104732Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handlerinilerm Advanced IP Blocker
- CVE-2026-107645Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parametercreativethemeshq Blocksy Companion
High 143
- CVE-2026-108677JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByNameJeecgBoot
- CVE-2026-108671JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryByIdJeecgBoot
- CVE-2026-108661JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenantJeecgBoot
- CVE-2026-108657JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApplyJeecgBoot
- CVE-2026-108648JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode EndpointJeecgBoot
- CVE-2026-108628JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission EndpointJeecgBoot
- CVE-2026-108623JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatchJeecgBoot
- CVE-2026-27350WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerabilityBuilderius.io Builderius
- CVE-2026-57742WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerabilityThemeREX Group Kids Planet
- CVE-2026-78534WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerabilityKeen IT Solutions Educavo
- CVE-2026-78532WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerabilitydesignthemes LMS
- CVE-2026-78530WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerabilityChimpstudio FoodBakery
- CVE-2026-66566WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerabilityElated-Themes Ambient
- CVE-2026-65459WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerabilityWPMU DEV Forminator
- CVE-2026-62130WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerabilityAmir Helzer WooCommerce Multilingual & Multicurrency
- CVE-2026-62118WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerabilityDmitry V. Barcode Scanner with Inventory & Order Manager
- CVE-2026-62117WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerabilityDmitry V. Barcode Scanner with Inventory & Order Manager
- CVE-2026-62116WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerabilityDmitry V. Barcode Scanner with Inventory & Order Manager
- CVE-2026-62115WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerabilitykutethemes KuteShop
- CVE-2026-62100WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilitykutethemes KuteShop
- CVE-2026-62099WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerabilitykutethemes Boutique
- CVE-2026-62096WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerabilitykutethemes Biolife
- CVE-2026-62095WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilitykutethemes Biolife
- CVE-2026-62094WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerabilitykutethemes TechOne
- CVE-2026-62093WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilitykutethemes TechOne
- CVE-2026-62092WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerabilitykutethemes Armania
- CVE-2026-62091WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilitykutethemes Armania
- CVE-2026-62082WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAn-Themes Pin WP
- CVE-2026-62075WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerabilityMymoun Backhoe
- CVE-2026-62074WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerabilityThemeREX Ozeum
- CVE-2026-62070WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerabilityCKThemes Flipmart
- CVE-2026-62069WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerabilityCocoBasic Fabius
- CVE-2026-62068WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerabilityCocoBasic Teoro
- CVE-2026-62067WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerabilityCocoBasic Kaven
- CVE-2026-62066WordPress Volos theme <= 1.2 - Local File Inclusion vulnerabilityCocoBasic Volos
- CVE-2026-62065WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerabilityCocoBasic Cardea
- CVE-2026-62064WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityBracketweb Ambed
- CVE-2026-62043WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerabilitysevenspark Contact Form 7 – Dynamic Text Extension
- CVE-2026-62038WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerabilityDigitalME eRoom
- CVE-2026-62037WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilitybPlugins Document Embedder
- CVE-2026-62034WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerabilitybPlugins Before After Image Comparison – Image comparison f…
- CVE-2026-62033WordPress uListing plugin <= 2.2.0 - Settings Change vulnerabilityStylemix uListing
- CVE-2026-62030WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerabilitybPlugins StreamCast
- CVE-2026-62027WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerabilitybPlugins Team Section Block
- CVE-2026-62021WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerabilityrascals Angio
- CVE-2026-62020WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerabilityMikado-Themes TouchUp
- CVE-2026-48194WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerabilitykutethemes DukaMarket
- CVE-2026-48193WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerabilitykutethemes Uminex
- CVE-2026-45440WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerabilitySmackcoders WP Ultimate CSV Importer
- CVE-2026-42777WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerabilityEdge-Themes Aalto
- CVE-2026-42724WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerabilityAncoraThemes CleanSkin
- CVE-2026-42722WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerabilityShabti Kaplan Frontend Admin by DynamiApps
- CVE-2026-42717WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerabilityVaultDweller Leyka
- CVE-2026-42715WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerabilityPhoto Gallery by 10Web
- CVE-2026-42712WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerabilityQode Tours
- CVE-2026-42711WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerabilitySlider by 10Web
- CVE-2026-42709WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerabilityRadiusTheme Food Menu – Restaurant Menu & Online Ordering f…
- CVE-2026-42706WordPress DK theme <= 3.2.1 - Broken Access Control vulnerabilityThemeGoods DK
- CVE-2026-42705WordPress Grand News theme <= 3.4 - Broken Access Control vulnerabilityThemeGoods Grand News
- CVE-2026-42704WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerabilityaxiomthemes Kids Care
- CVE-2026-42702WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS
- CVE-2026-42699WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerabilityFolioVision FV Player
- CVE-2026-42697WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerabilityInisev Social Share Icons & Social Share Buttons
- CVE-2026-42693WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerabilityTieLabs Jannah
- CVE-2026-42633WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerabilityMarcus Events Manager
- CVE-2026-42632WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerabilityQode Real Estate
- CVE-2026-42631WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerabilityQode Music
- CVE-2026-42630WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerabilityWeb Plura Backup & Restore Manager
- CVE-2026-40805WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerabilityPeepSo
- CVE-2026-40803WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerabilityJotform – AI Chatbot
- CVE-2026-40802WordPress Pubjet | پابجت plugin <= 5.4.8 - Settings Change vulnerabilityPubjet | پابجت
- CVE-2026-40801WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerabilityWordable
- CVE-2026-40777WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerabilityRashid WPSection
- CVE-2026-39802WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerabilityeverestthemes Everest Backup
- CVE-2026-39800WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerabilityAnton Bond Additional Order Filters for WooCommerce
- CVE-2026-39799WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerabilityJoomunited WP File Download
- CVE-2026-57806WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerabilitydrfuri Martfury - WooCommerce Marketplace WordPress Theme
- CVE-2026-1085939router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpointdecolua 9router
- CVE-2026-96341WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerabilityWPMU DEV Forminator
- CVE-2026-103071WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerabilityVillaTheme Thank You Page Customizer for WooCommerce
- CVE-2026-106608WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerabilityAutomattic WooCommerce
- CVE-2026-106609WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerabilityWeb Impian Bayarcash WooCommerce
- CVE-2026-94160WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeStek Extras for LabtechCO Theme
- CVE-2026-62044WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerabilitybPlugins Super Video Player
- CVE-2026-108581Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providersTencentCloud Octop
- CVE-2026-108553OpenRefine through 3.10.1 CSRF to RCE via get-rows CommandOpenRefine
- CVE-2026-108550SkillHub before 0.2.22 Account Takeover via Account Merge Flowiflytek skillhub
- CVE-2026-108547AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-variflytek astron-rpa
- CVE-2026-108546Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integrationspotweb
- CVE-2026-108545SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body ParsingSillyTavern
- CVE-2026-97264WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityGreg Winiarski WPAdverts
- CVE-2026-97263WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerabilityGreg Winiarski WPAdverts
- CVE-2026-94676WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerabilityTainacan Community Tainacan
- CVE-2026-105885WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerabilitySlider by 10Web
- CVE-2026-102388WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV Forminator
- CVE-2026-108164Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Routeopensource-socialnetwork
- CVE-2026-108161FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Downloadfusionpbx
- CVE-2026-107794ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty listExtUtils-Typemaps-Default
- CVE-2013-10076ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty listExtUtils-Typemaps-Default
- CVE-2026-103636Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketchApache Software Foundation Apache DataSketches
- CVE-2026-107657HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration FormHivePress – Business Directory, Listings & Classified Ads P…
- CVE-2026-91136Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' ParameterDivi Essential Divi Plus
- CVE-2026-93951WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityBracketweb Zeinet
- CVE-2026-93746WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' ParameterWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…
- CVE-2026-104759WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce VerificationWPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION
- CVE-2026-100178WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parametergwin WPAdverts – Classifieds Plugin
- CVE-2026-96765WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION
- CVE-2026-101920Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href AttributeMolongui Authorship – Author Boxes, Guest Authors & Co-Auth…
- CVE-2026-96662Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' ParameterAppointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-100147FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)teamfunnelkit FunnelKit – Funnel Builder for WooCommerce Ch…
- CVE-2026-96278WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session Historyopajaap WP Photo Album Plus
- CVE-2026-93950WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerabilityStylemixThemes Motors
- CVE-2026-93949WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerabilityOmegathemes Grocery Shopping Store
- CVE-2026-106606WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerabilityYITH WooCommerce Affiliates
- CVE-2026-96572WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Nameaguidrevitch WP Meteor Website Speed Optimization Addon
- CVE-2026-10774210Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name10Web Booster – Website speed optimization, Cache & Page Sp…
- CVE-2026-100196LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Contentwp_media LazyLoad Plugin – Lazy Load Images, Videos, and If…
- CVE-2026-100161Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parametervillatheme Photo Reviews for WooCommerce
- CVE-2026-94538WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple FunctionsJoomUnited WP File Download
- CVE-2026-12626Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameterladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-95684VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parametere4jvikwp VikBooking Hotel Booking Engine & PMS
- CVE-2026-96840Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Fieldwpxpo Post Grid Gutenberg Blocks – PostX
- CVE-2026-96558Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameterexpresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…
- CVE-2026-94257SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password ResetSMS Alert
- CVE-2026-94256SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTPSMS Alert
- CVE-2026-87781LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' ParameterLTL Freight Quotes
- CVE-2026-87780LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping RulesLTL Freight Quotes
- CVE-2026-104752Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings ImportRank Math SEO
- CVE-2026-14335Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameterssmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2026-93775Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhooketeubert Podlove Podcast Publisher
- CVE-2026-104723LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson DataLifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- CVE-2026-96682Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag2winfactor Presto Player
- CVE-2026-92975Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusiontrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2026-104899GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameterpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-77183FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST EndpointFooSales – Point of Sale (POS) for WooCommerce
- CVE-2026-96667Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameterrameez_iqbal Real Estate Manager – Property Listing and Age…
- CVE-2026-104725Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parametertrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2026-83526FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameterfoliovision FV Player
- CVE-2026-104766Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' ParameterAppointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-89301rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameterrtcamp rtMedia for WordPress, BuddyPress and bbPress
- CVE-2026-104021Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Settinghostspa Fastcache by Host.it
- CVE-2026-104797Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Actionnasirahmed Advanced Form Integration — Connect Forms to 300…
- CVE-2026-101947ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV exportCellHubs ExifTool for photo and video
Medium, low and unrated 191
- CVE-2026-108680JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncementJeecgBoot
- CVE-2026-108679JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncementJeecgBoot
- CVE-2026-108678JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesJeecgBoot
- CVE-2026-108676JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFilesJeecgBoot
- CVE-2026-108675JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTopJeecgBoot
- CVE-2026-108674JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryByIdJeecgBoot
- CVE-2026-108673JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXlsJeecgBoot
- CVE-2026-108672JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUserJeecgBoot
- CVE-2026-108670JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experimentJeecgBoot
- CVE-2026-108669JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/searchJeecgBoot
- CVE-2026-108668JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBinJeecgBoot
- CVE-2026-108667JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBinJeecgBoot
- CVE-2026-108666JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatchJeecgBoot
- CVE-2026-108665JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/editJeecgBoot
- CVE-2026-108664JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryByIdJeecgBoot
- CVE-2026-108663JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApplyJeecgBoot
- CVE-2026-108662JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUserJeecgBoot
- CVE-2026-108660JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatusJeecgBoot
- CVE-2026-108659JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserIdJeecgBoot
- CVE-2026-108658JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfoJeecgBoot
- CVE-2026-108656JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers EndpointJeecgBoot
- CVE-2026-108655JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryByIdJeecgBoot
- CVE-2026-108654JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryByIdJeecgBoot
- CVE-2026-108653JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/listJeecgBoot
- CVE-2026-108652JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatarJeecgBoot
- CVE-2026-108651JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserIdJeecgBoot
- CVE-2026-108650JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSetJeecgBoot
- CVE-2026-108649JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesByIdJeecgBoot
- CVE-2026-108647JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcelJeecgBoot
- CVE-2026-108646JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcelJeecgBoot
- CVE-2026-108645JeecgBoot through 3.9.5 Missing Authorization via /sys/category/editJeecgBoot
- CVE-2026-108644JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteJeecgBoot
- CVE-2026-108643JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatchJeecgBoot
- CVE-2026-108642JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/editJeecgBoot
- CVE-2026-108641JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOneJeecgBoot
- CVE-2026-108640JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryByIdJeecgBoot
- CVE-2026-108639JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}JeecgBoot
- CVE-2026-108638JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUserJeecgBoot
- CVE-2026-108637JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch EndpointJeecgBoot
- CVE-2026-108636JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcelJeecgBoot
- CVE-2026-108635JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead EndpointJeecgBoot
- CVE-2026-108634JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch EndpointJeecgBoot
- CVE-2026-108633JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/addJeecgBoot
- CVE-2026-108632JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById EndpointJeecgBoot
- CVE-2026-108631JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/deleteJeecgBoot
- CVE-2026-108630JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/editJeecgBoot
- CVE-2026-108629JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule EndpointJeecgBoot
- CVE-2026-108627JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule EndpointJeecgBoot
- CVE-2026-108626JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById EndpointJeecgBoot
- CVE-2026-108625JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit EndpointJeecgBoot
- CVE-2026-108624JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch EndpointJeecgBoot
- CVE-2026-108622JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete EndpointJeecgBoot
- CVE-2026-108621JeecgBoot through 3.9.5 Missing Authorization via /sys/position/editJeecgBoot
- CVE-2026-108620JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatchJeecgBoot
- CVE-2026-108619JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch EndpointJeecgBoot
- CVE-2026-108618JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit EndpointJeecgBoot
- CVE-2026-108617JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add EndpointJeecgBoot
- CVE-2026-108616JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatchJeecgBoot
- CVE-2026-108615JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteJeecgBoot
- CVE-2026-108614JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXlsJeecgBoot
- CVE-2026-108613JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release EndpointJeecgBoot
- CVE-2026-108612JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatchJeecgBoot
- CVE-2026-108611JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete EndpointJeecgBoot
- CVE-2026-108610JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit EndpointJeecgBoot
- CVE-2026-108609JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId ParameterJeecgBoot
- CVE-2026-108608JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId ParameterJeecgBoot
- CVE-2026-108607JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId ParameterJeecgBoot
- CVE-2026-108606JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteByIdJeecgBoot
- CVE-2026-108605JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit EndpointJeecgBoot
- CVE-2026-103685WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerabilityVillaTheme ALD – Dropshipping and Fulfillment for AliExpres…
- CVE-2026-108604Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT ClassificationTabularisDB tabularis
- CVE-2026-108603slide-maker through 5.8.0 Path Traversal via generate_images_openai.pyaddsumtech slide-maker
- CVE-2026-108602Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolutionhelicone
- CVE-2026-97853Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoSericmj decimal · decimal
- CVE-2026-66480WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerabilityYITH WooCommerce Product Add-Ons
- CVE-2026-107434WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerabilityvideowhisper MicroPayments
- CVE-2026-107420WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerabilityNarinder Singh Pay With MetaMask For WooCommerce – Cryptocu…
- CVE-2026-66481WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerabilityPresto Player Pro
- CVE-2026-62098WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerabilitykutethemes Boutique
- CVE-2026-62035WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerabilityAWS S3 for WordPress Plugin – Upcasted
- CVE-2026-42419WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerabilitySwishFolio Swish Migrate and Backup
- CVE-2026-40808WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerabilityAutomattic Jetpack VideoPress
- CVE-2026-108600open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlinkopen-multi-agent
- CVE-2026-108599Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypasspulseaiclub phi
- CVE-2026-108597Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extractioncohere-ai cohere-python
- CVE-2026-108596OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Headeropenlit
- CVE-2026-94590WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerabilityCodePeople2 Sell Downloads
- CVE-2026-108595Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdirpulseaiclub phi
- CVE-2026-108594Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetchmealie-recipes mealie
- CVE-2026-108592mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironmentmini-swe-agent
- CVE-2026-108591InnoShop 0.9.2 Local File Disclosure via AI Core MCP file_upload Toolinnocommerce InnoShop
- CVE-2026-103357WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerabilityVillaTheme GIFT4U
- CVE-2026-1085861MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter1mcp-app @1mcp/agent
- CVE-2026-108585argocd-mcp through 0.9.0 Path Traversal via delete_application Toolargoproj-labs argocd-mcp
- CVE-2026-108583zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool54yyyu zotero-mcp
- CVE-2026-108582GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Storegenspark-ai GenOffice
- CVE-2026-108580AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /loginphoenixthrush AniWorld Downloader
- CVE-2026-108579OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member ExportOpenpanel-dev openpanel
- CVE-2026-108555PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Headerschlagmichdoch PairDrop
- CVE-2026-108554PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link InputPDFMathTranslate
- CVE-2026-108548AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Tokeniflytek astron-rpa
- CVE-2026-108115Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresseskortix-ai suna
- CVE-2026-108114Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissionsstrapi
- CVE-2026-66435WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerabilityDevin Walker WP Rollback
- CVE-2026-108165Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadataimmich-app immich
- CVE-2026-108163Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTLsmp46 pingvin-share-x
- CVE-2026-108162Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-Forsmp46 pingvin-share-x
- CVE-2026-106139Cross-Site Scripting via Chart Tooltip in Kendo UI for VueProgress Software Kendo UI for Vue
- CVE-2026-106138Cross-Site Scripting via Chart Tooltip in KendoReactProgress Software KendoReact
- CVE-2026-108506Unauthorized access vulnerability in ZTE Z80 Ultra productZTE Z80 Ultra
- CVE-2026-108505Information disclosure vulnerability in ZTE Z80 Ultra productZTE Z80 Ultra
- CVE-2026-4791PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' AttributePeproDev Ultimate Profile Solutions
- CVE-2026-104722Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameterwebilia Listdom: AI-powered Business Directory with Classif…
- CVE-2026-103478Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parametercodename065 Premium Packages – Sell Digital Products Secure…
- CVE-2026-97340Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile FieldThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2026-102291Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'themeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-102774SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Contentbrainstormforce SureDash – Community, Courses & Member Dash…
- CVE-2026-104728AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Actionrubengc AutomatorWP – No-Code Workflow Automation, Integrat…
- CVE-2026-96653WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)wpdirectorykit WP Directory Kit
- CVE-2026-97396Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST EndpointEmail Marketing for WordPress and WooCommerce – Retainful
- CVE-2026-101921WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attributesmub WPForms – AI Form Builder for WordPress – Contact Form…
- CVE-2026-96563Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameterstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-108504Unauthorized information retrieval vulnerability in ZTE Z80 Ultra productZTE Z80 Ultra
- CVE-2026-108503Unauthorized information acquisition vulnerability in ZTE Z80 Ultra productZTE Z80 Ultra
- CVE-2026-103427Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Fieldwpinsider-1 Simple Membership
- CVE-2026-104006SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Checksoftaculous SpeedyCache – Cache, Optimization, Performance
- CVE-2026-3717CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Uploadbestwpdeveloper WP CV Builder
- CVE-2026-102402Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcodetechlabpro1 Team – Team Members Showcase Plugin
- CVE-2026-6243Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Contentshabti Frontend Admin by DynamiApps
- CVE-2026-5725Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefixarchetyped Favicon Rotator
- CVE-2026-107712WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parametermurgroland WP Booking System – Booking Calendar
- CVE-2026-103897Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attributedfactory Responsive Lightbox & Gallery
- CVE-2026-89100Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragmentpaymentplugins Payment Plugins for Stripe WooCommerce
- CVE-2026-97348SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)gpriday SiteOrigin Widgets Bundle
- CVE-2026-96574User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameterwedevs User Frontend – Membership, User Registration, User…
- CVE-2026-15178Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modificationwpmanageninja Fluent Forms – Customizable Contact Forms, Su…
- CVE-2026-108502Information disclosure vulnerability in ZTE Z80 Ultra productZTE Z80 Ultra
- CVE-2026-85571Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDORTutor LMS
- CVE-2026-107323Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSSGallery PhotoBlocks
- CVE-2026-107321W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library ImportW3 Total Cache
- CVE-2026-107120Contest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PINContest Gallery
- CVE-2026-105995Booking Package < 1.7.30 - Unauthenticated Booking Customer PII DisclosureBooking Package
- CVE-2026-105990Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV ExportAccept PayPal Payments using Contact Form
- CVE-2026-105989Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status ForgeryAccept PayPal Payments using Contact Form
- CVE-2026-105977Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnailPortfolio Filter Gallery
- CVE-2026-105976Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX ActionsPortfolio Filter Gallery
- CVE-2026-104754Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URLRank Math SEO
- CVE-2026-104753Rank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' ParameterRank Math SEO
- CVE-2026-12054Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parametercodename065 Download Manager
- CVE-2026-17025Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fieldssilverks Graphene
- CVE-2026-14882Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Metathemefusecom Brizy – Page Builder
- CVE-2026-103912JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Rendererjetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-103482Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivotpicocodes Noptin – Newsletter, New Post Notifications & Ema…
- CVE-2026-14877Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attributesupsysticcom Data Tables Generator by Supsystic
- CVE-2026-97643GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributesstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2026-104762Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attributestellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…
- CVE-2026-18558Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcodeawsmin Embed Any Document – Embed PDF, Word, PowerPoint and…
- CVE-2026-91862Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'jetmonsters Getwid – Gutenberg Blocks
- CVE-2026-94421Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameterandy_moyle Church Admin
- CVE-2026-94375Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()webtoffee Order Export & Order Import for WooCommerce
- CVE-2026-103520HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML FormatHivePress – Business Directory, Listings & Classified Ads P…
- CVE-2026-104763Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.jsonwpazleen Post Export Import with Media
- CVE-2026-14379GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameterrubengc GamiPress – Gamification plugin to reward points, b…
- CVE-2026-16776MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesMP3 Audio Player – Music Player, Podcast Player & Radio by…
- CVE-2026-104742AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX actionsenols AI Puffer – AI Chatbot, AI Writer & Automation
- CVE-2026-104741AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpointsenols AI Puffer – AI Chatbot, AI Writer & Automation
- CVE-2026-78068Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Contentjonua Table Field Add-on for ACF and SCF
- CVE-2026-104023Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parametersupsysticcom Smart Popup by Supsystic
- CVE-2026-18496Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Actionwpdevelop Booking Calendar
- CVE-2026-91050Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' ParameterAppointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-9696Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcodecodename065 Download Manager
- CVE-2026-104724FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Conditionfireplugins FireBox – WooCommerce Popup Builder, Exit Inten…
- CVE-2026-103998Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array KeyForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-103424Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy RegexAnti-Spam by CleanTalk – Spam Protection Without CAPTCHA
- CVE-2026-6723Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Tokencroixhaug Simply Schedule Appointments
- CVE-2026-104735RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2026-103964Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Emailcodename065 Download Manager
- CVE-2026-87869Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URLstepasyuk Filter Everything — WordPress & WooCommerce Filte…
- CVE-2026-97630FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attributefoliovision FV Flowplayer Video Player
- CVE-2026-5727Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_siteelemntor Hello Plus
- CVE-2026-102401Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attributecodename065 Download Manager
- CVE-2026-101324Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameterwpmanageninja Fluent Forms – Customizable Contact Forms, Su…
- CVE-2026-104993GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Fieldpaoltaia GeoDirectory – WP Business Directory Plugin and Cl…
- CVE-2026-96648Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Actionsupsysticcom Data Tables Generator by Supsystic
- CVE-2026-108501Unauthorized access vulnerability in ZTE Z80 Ultra productZTE Z80 Ultra
- CVE-2026-103365Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_detailsladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-96743Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Valuejonua Table Field Add-on for ACF and SCF
- CVE-2026-104898Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Bodyladela Online Scheduling and Appointment Booking System – B…
- CVE-2026-104022Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpointkodezen Academy LMS – AI Course Builder, Quizzes, Certifica…
- CVE-2026-93883Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameterpluginsware Advanced Classifieds & Directory Pro
- CVE-2026-104915Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_idkodezen Academy LMS – AI Course Builder, Quizzes, Certifica…