# CVEs published 2026-10-10

411 CVEs were published on October 10, 2026: 77 critical, 143 high. Days are UTC.

- [CVE-2026-108680](https://cve.now/CVE-2026-108680.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement (CVSS 5.3, JeecgBoot)
- [CVE-2026-108679](https://cve.now/CVE-2026-108679.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement (CVSS 5.3, JeecgBoot)
- [CVE-2026-108678](https://cve.now/CVE-2026-108678.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles (CVSS 5.3, JeecgBoot)
- [CVE-2026-108677](https://cve.now/CVE-2026-108677.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName (CVSS 7.1, JeecgBoot)
- [CVE-2026-108676](https://cve.now/CVE-2026-108676.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles (CVSS 5.3, JeecgBoot)
- [CVE-2026-108675](https://cve.now/CVE-2026-108675.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop (CVSS 5.3, JeecgBoot)
- [CVE-2026-108674](https://cve.now/CVE-2026-108674.md): JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById (CVSS 5.3, JeecgBoot)
- [CVE-2026-108673](https://cve.now/CVE-2026-108673.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls (CVSS 5.3, JeecgBoot)
- [CVE-2026-108672](https://cve.now/CVE-2026-108672.md): JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser (CVSS 5.3, JeecgBoot)
- [CVE-2026-108671](https://cve.now/CVE-2026-108671.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById (CVSS 7.1, JeecgBoot)
- [CVE-2026-108670](https://cve.now/CVE-2026-108670.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment (CVSS 5.3, JeecgBoot)
- [CVE-2026-108669](https://cve.now/CVE-2026-108669.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search (CVSS 5.3, JeecgBoot)
- [CVE-2026-108668](https://cve.now/CVE-2026-108668.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin (CVSS 5.3, JeecgBoot)
- [CVE-2026-108667](https://cve.now/CVE-2026-108667.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin (CVSS 5.3, JeecgBoot)
- [CVE-2026-108666](https://cve.now/CVE-2026-108666.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch (CVSS 5.3, JeecgBoot)
- [CVE-2026-108665](https://cve.now/CVE-2026-108665.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit (CVSS 5.3, JeecgBoot)
- [CVE-2026-108664](https://cve.now/CVE-2026-108664.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById (CVSS 5.3, JeecgBoot)
- [CVE-2026-108663](https://cve.now/CVE-2026-108663.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply (CVSS 5.3, JeecgBoot)
- [CVE-2026-108662](https://cve.now/CVE-2026-108662.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser (CVSS 5.3, JeecgBoot)
- [CVE-2026-108661](https://cve.now/CVE-2026-108661.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant (CVSS 7.1, JeecgBoot)
- [CVE-2026-108660](https://cve.now/CVE-2026-108660.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus (CVSS 5.3, JeecgBoot)
- [CVE-2026-108659](https://cve.now/CVE-2026-108659.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId (CVSS 5.3, JeecgBoot)
- [CVE-2026-108658](https://cve.now/CVE-2026-108658.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo (CVSS 5.3, JeecgBoot)
- [CVE-2026-108657](https://cve.now/CVE-2026-108657.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply (CVSS 8.6, JeecgBoot)
- [CVE-2026-108656](https://cve.now/CVE-2026-108656.md): JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108655](https://cve.now/CVE-2026-108655.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById (CVSS 5.3, JeecgBoot)
- [CVE-2026-108654](https://cve.now/CVE-2026-108654.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById (CVSS 5.3, JeecgBoot)
- [CVE-2026-108653](https://cve.now/CVE-2026-108653.md): JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list (CVSS 5.3, JeecgBoot)
- [CVE-2026-108652](https://cve.now/CVE-2026-108652.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar (CVSS 5.3, JeecgBoot)
- [CVE-2026-108651](https://cve.now/CVE-2026-108651.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId (CVSS 5.3, JeecgBoot)
- [CVE-2026-108650](https://cve.now/CVE-2026-108650.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet (CVSS 5.3, JeecgBoot)
- [CVE-2026-108649](https://cve.now/CVE-2026-108649.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById (CVSS 5.3, JeecgBoot)
- [CVE-2026-108648](https://cve.now/CVE-2026-108648.md): JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint (CVSS 7.1, JeecgBoot)
- [CVE-2026-108647](https://cve.now/CVE-2026-108647.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel (CVSS 5.3, JeecgBoot)
- [CVE-2026-108646](https://cve.now/CVE-2026-108646.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel (CVSS 5.3, JeecgBoot)
- [CVE-2026-108645](https://cve.now/CVE-2026-108645.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit (CVSS 5.3, JeecgBoot)
- [CVE-2026-108644](https://cve.now/CVE-2026-108644.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete (CVSS 5.3, JeecgBoot)
- [CVE-2026-108643](https://cve.now/CVE-2026-108643.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch (CVSS 5.3, JeecgBoot)
- [CVE-2026-108642](https://cve.now/CVE-2026-108642.md): JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit (CVSS 5.3, JeecgBoot)
- [CVE-2026-108641](https://cve.now/CVE-2026-108641.md): JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne (CVSS 5.3, JeecgBoot)
- [CVE-2026-108640](https://cve.now/CVE-2026-108640.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById (CVSS 5.3, JeecgBoot)
- [CVE-2026-108639](https://cve.now/CVE-2026-108639.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id} (CVSS 5.3, JeecgBoot)
- [CVE-2026-108638](https://cve.now/CVE-2026-108638.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser (CVSS 5.3, JeecgBoot)
- [CVE-2026-108637](https://cve.now/CVE-2026-108637.md): JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108636](https://cve.now/CVE-2026-108636.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel (CVSS 5.3, JeecgBoot)
- [CVE-2026-108635](https://cve.now/CVE-2026-108635.md): JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108634](https://cve.now/CVE-2026-108634.md): JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108633](https://cve.now/CVE-2026-108633.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add (CVSS 5.3, JeecgBoot)
- [CVE-2026-108632](https://cve.now/CVE-2026-108632.md): JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108631](https://cve.now/CVE-2026-108631.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete (CVSS 5.3, JeecgBoot)
- [CVE-2026-108630](https://cve.now/CVE-2026-108630.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit (CVSS 5.3, JeecgBoot)
- [CVE-2026-108629](https://cve.now/CVE-2026-108629.md): JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108628](https://cve.now/CVE-2026-108628.md): JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint (CVSS 8.6, JeecgBoot)
- [CVE-2026-108627](https://cve.now/CVE-2026-108627.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108626](https://cve.now/CVE-2026-108626.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108625](https://cve.now/CVE-2026-108625.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108624](https://cve.now/CVE-2026-108624.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108623](https://cve.now/CVE-2026-108623.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch (CVSS 7.1, JeecgBoot)
- [CVE-2026-108622](https://cve.now/CVE-2026-108622.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108621](https://cve.now/CVE-2026-108621.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit (CVSS 5.3, JeecgBoot)
- [CVE-2026-108620](https://cve.now/CVE-2026-108620.md): JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch (CVSS 5.3, JeecgBoot)
- [CVE-2026-108619](https://cve.now/CVE-2026-108619.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108618](https://cve.now/CVE-2026-108618.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108617](https://cve.now/CVE-2026-108617.md): JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108616](https://cve.now/CVE-2026-108616.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch (CVSS 5.3, JeecgBoot)
- [CVE-2026-108615](https://cve.now/CVE-2026-108615.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete (CVSS 5.3, JeecgBoot)
- [CVE-2026-108614](https://cve.now/CVE-2026-108614.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls (CVSS 5.3, JeecgBoot)
- [CVE-2026-108613](https://cve.now/CVE-2026-108613.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108612](https://cve.now/CVE-2026-108612.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch (CVSS 5.3, JeecgBoot)
- [CVE-2026-108611](https://cve.now/CVE-2026-108611.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108610](https://cve.now/CVE-2026-108610.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-108609](https://cve.now/CVE-2026-108609.md): JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter (CVSS 5.3, JeecgBoot)
- [CVE-2026-108608](https://cve.now/CVE-2026-108608.md): JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter (CVSS 5.3, JeecgBoot)
- [CVE-2026-108607](https://cve.now/CVE-2026-108607.md): JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter (CVSS 5.3, JeecgBoot)
- [CVE-2026-108606](https://cve.now/CVE-2026-108606.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById (CVSS 5.3, JeecgBoot)
- [CVE-2026-108605](https://cve.now/CVE-2026-108605.md): JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint (CVSS 5.3, JeecgBoot)
- [CVE-2026-103685](https://cve.now/CVE-2026-103685.md): WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin \<= 2.2.4 - Broken Access Control vulnerability (CVSS 4.3, VillaTheme ALD – Dropshipping and Fulfillment for AliExpres…)
- [CVE-2026-108604](https://cve.now/CVE-2026-108604.md): Tabularis through 0.27.0 Read-Only Bypass via MCP run\_query SELECT Classification (CVSS 5.8, TabularisDB tabularis)
- [CVE-2026-108603](https://cve.now/CVE-2026-108603.md): slide-maker through 5.8.0 Path Traversal via generate\_images\_openai.py (CVSS 4.8, addsumtech slide-maker)
- [CVE-2026-108602](https://cve.now/CVE-2026-108602.md): Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution (CVSS 5.3, helicone)
- [CVE-2026-27350](https://cve.now/CVE-2026-27350.md): WordPress Builderius plugin \<= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, Builderius.io Builderius)
- [CVE-2026-97853](https://cve.now/CVE-2026-97853.md): Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS (CVSS 6.9, ericmj decimal · decimal)
- [CVE-2026-66480](https://cve.now/CVE-2026-66480.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.34.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, YITH WooCommerce Product Add-Ons)
- [CVE-2026-57742](https://cve.now/CVE-2026-57742.md): WordPress Kids Planet theme \<= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeREX Group Kids Planet)
- [CVE-2026-107434](https://cve.now/CVE-2026-107434.md): WordPress MicroPayments plugin \<= 3.2.9 - Bypass Vulnerability vulnerability (CVSS 5.4, videowhisper MicroPayments)
- [CVE-2026-107420](https://cve.now/CVE-2026-107420.md): WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin \<= 1.7.2 - Bypass Vulnerability vulnerability (CVSS 5.3, Narinder Singh Pay With MetaMask For WooCommerce – Cryptocu…)
- [CVE-2026-81797](https://cve.now/CVE-2026-81797.md): WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme \<= 1.0.2 - PHP Object Injection vulnerability (CVSS 9.8, ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme)
- [CVE-2026-78535](https://cve.now/CVE-2026-78535.md): WordPress Photolia theme \<= 1.0.3 - PHP Object Injection vulnerability (CVSS 9.8, ThemeRex Photolia)
- [CVE-2026-78534](https://cve.now/CVE-2026-78534.md): WordPress Educavo theme \<= 3.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Keen IT Solutions Educavo)
- [CVE-2026-78533](https://cve.now/CVE-2026-78533.md): WordPress Qwery theme \<= 3.6.1 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes Qwery)
- [CVE-2026-78532](https://cve.now/CVE-2026-78532.md): WordPress LMS theme \<= 8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, designthemes LMS)
- [CVE-2026-78531](https://cve.now/CVE-2026-78531.md): WordPress Jacqueline theme \<= 2.22 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Jacqueline)
- [CVE-2026-78530](https://cve.now/CVE-2026-78530.md): WordPress FoodBakery theme \<= 4.6 - Arbitrary File Deletion vulnerability (CVSS 7.7, Chimpstudio FoodBakery)
- [CVE-2026-78529](https://cve.now/CVE-2026-78529.md): WordPress Alliance theme \<= 3.11 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Alliance)
- [CVE-2026-66569](https://cve.now/CVE-2026-66569.md): WordPress Kicker theme \<= 2.2.1 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes Kicker)
- [CVE-2026-66568](https://cve.now/CVE-2026-66568.md): WordPress Original theme \<= 1.9.0 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes Original)
- [CVE-2026-66567](https://cve.now/CVE-2026-66567.md): WordPress Anesta theme \<= 1.5.3 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes Anesta)
- [CVE-2026-66566](https://cve.now/CVE-2026-66566.md): WordPress Ambient theme \<= 1.7 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes Ambient)
- [CVE-2026-66565](https://cve.now/CVE-2026-66565.md): WordPress FC United theme \<= 1.1.1 - PHP Object Injection vulnerability (CVSS 9.8, axiomthemes FC United)
- [CVE-2026-66564](https://cve.now/CVE-2026-66564.md): WordPress ShiftCV theme \<= 3.0.14 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX ShiftCV)
- [CVE-2026-66563](https://cve.now/CVE-2026-66563.md): WordPress Windsor theme \<= 2.10 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Windsor)
- [CVE-2026-66483](https://cve.now/CVE-2026-66483.md): WordPress Education Center theme \<= 3.6.12 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Education Center)
- [CVE-2026-66482](https://cve.now/CVE-2026-66482.md): WordPress Drone Media theme \<= 2.2.0 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes Drone Media)
- [CVE-2026-66481](https://cve.now/CVE-2026-66481.md): WordPress Presto Player Pro plugin \<= 3.0.1 - Arbitrary File Deletion vulnerability (CVSS 6.8, Presto Player Pro)
- [CVE-2026-65459](https://cve.now/CVE-2026-65459.md): WordPress Forminator plugin \<= 1.57.3 - Arbitrary Content Deletion vulnerability (CVSS 7.5, WPMU DEV Forminator)
- [CVE-2026-62130](https://cve.now/CVE-2026-62130.md): WordPress WooCommerce Multilingual & Multicurrency plugin \<= 5.5.8 - PHP Object Injection vulnerability (CVSS 7.2, Amir Helzer WooCommerce Multilingual & Multicurrency)
- [CVE-2026-62129](https://cve.now/CVE-2026-62129.md): WordPress Creator LMS plugin \<= 1.2.21 - Arbitrary File Upload vulnerability (CVSS 9.9, WPFunnels Creator LMS)
- [CVE-2026-62125](https://cve.now/CVE-2026-62125.md): WordPress Asia Garden theme \<= 1.3.1 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Asia Garden)
- [CVE-2026-62124](https://cve.now/CVE-2026-62124.md): WordPress N7 | Golf Club Sports & Events theme \<= 2.21 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX N7 | Golf Club Sports & Events)
- [CVE-2026-62123](https://cve.now/CVE-2026-62123.md): WordPress Invetex theme \<= 2.18 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Invetex)
- [CVE-2026-62120](https://cve.now/CVE-2026-62120.md): WordPress Law Office theme \<= 3.20 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Law Office)
- [CVE-2026-62118](https://cve.now/CVE-2026-62118.md): WordPress Barcode Scanner with Inventory & Order Manager plugin \<= 1.13.1 - Broken Access Control vulnerability (CVSS 7.3, Dmitry V. Barcode Scanner with Inventory & Order Manager)
- [CVE-2026-62117](https://cve.now/CVE-2026-62117.md): WordPress Barcode Scanner with Inventory & Order Manager plugin \<= 1.13.1 - SQL Injection vulnerability (CVSS 8.5, Dmitry V. Barcode Scanner with Inventory & Order Manager)
- [CVE-2026-62116](https://cve.now/CVE-2026-62116.md): WordPress Barcode Scanner with Inventory & Order Manager plugin \<= 1.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dmitry V. Barcode Scanner with Inventory & Order Manager)
- [CVE-2026-62115](https://cve.now/CVE-2026-62115.md): WordPress KuteShop theme \<= 4.2.9 - Local File Inclusion vulnerability (CVSS 8.1, kutethemes KuteShop)
- [CVE-2026-62100](https://cve.now/CVE-2026-62100.md): WordPress KuteShop theme \<= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kutethemes KuteShop)
- [CVE-2026-62099](https://cve.now/CVE-2026-62099.md): WordPress Boutique theme \<= 2.3.3 - Local File Inclusion vulnerability (CVSS 8.1, kutethemes Boutique)
- [CVE-2026-62098](https://cve.now/CVE-2026-62098.md): WordPress Boutique theme \<= 2.3.3 - Arbitrary Shortcode Execution vulnerability (CVSS 6.5, kutethemes Boutique)
- [CVE-2026-62096](https://cve.now/CVE-2026-62096.md): WordPress Biolife theme \<= 3.2.3 - Local File Inclusion vulnerability (CVSS 8.1, kutethemes Biolife)
- [CVE-2026-62095](https://cve.now/CVE-2026-62095.md): WordPress Biolife theme \<= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kutethemes Biolife)
- [CVE-2026-62094](https://cve.now/CVE-2026-62094.md): WordPress TechOne theme \<= 3.0.3 - Local File Inclusion vulnerability (CVSS 8.1, kutethemes TechOne)
- [CVE-2026-62093](https://cve.now/CVE-2026-62093.md): WordPress TechOne theme \<= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kutethemes TechOne)
- [CVE-2026-62092](https://cve.now/CVE-2026-62092.md): WordPress Armania theme \<= 1.4.8 - Local File Inclusion vulnerability (CVSS 8.1, kutethemes Armania)
- [CVE-2026-62091](https://cve.now/CVE-2026-62091.md): WordPress Armania theme \<= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, kutethemes Armania)
- [CVE-2026-62090](https://cve.now/CVE-2026-62090.md): WordPress WineShop theme \<= 3.20 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX WineShop)
- [CVE-2026-62087](https://cve.now/CVE-2026-62087.md): WordPress Equadio theme \<= 1.1.4 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Equadio)
- [CVE-2026-62086](https://cve.now/CVE-2026-62086.md): WordPress Juno theme \<= 2.25 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Juno)
- [CVE-2026-62082](https://cve.now/CVE-2026-62082.md): WordPress Pin WP theme \<= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, An-Themes Pin WP)
- [CVE-2026-62077](https://cve.now/CVE-2026-62077.md): WordPress Avala theme \<= 1.1.4 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Avala)
- [CVE-2026-62076](https://cve.now/CVE-2026-62076.md): WordPress Kalles theme \<= 1.1.7.1 - PHP Object Injection vulnerability (CVSS 9.8, The4 Kalles)
- [CVE-2026-62075](https://cve.now/CVE-2026-62075.md): WordPress Backhoe theme \<= 2.0 - Local File Inclusion vulnerability (CVSS 8.1, Mymoun Backhoe)
- [CVE-2026-62074](https://cve.now/CVE-2026-62074.md): WordPress Ozeum theme \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Ozeum)
- [CVE-2026-62070](https://cve.now/CVE-2026-62070.md): WordPress Flipmart theme \<= 2.8 - Local File Inclusion vulnerability (CVSS 8.1, CKThemes Flipmart)
- [CVE-2026-62069](https://cve.now/CVE-2026-62069.md): WordPress Fabius theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1, CocoBasic Fabius)
- [CVE-2026-62068](https://cve.now/CVE-2026-62068.md): WordPress Teoro theme \<= 1.1 - Local File Inclusion vulnerability (CVSS 8.1, CocoBasic Teoro)
- [CVE-2026-62067](https://cve.now/CVE-2026-62067.md): WordPress Kaven theme \<= 1.2 - Local File Inclusion vulnerability (CVSS 8.1, CocoBasic Kaven)
- [CVE-2026-62066](https://cve.now/CVE-2026-62066.md): WordPress Volos theme \<= 1.2 - Local File Inclusion vulnerability (CVSS 8.1, CocoBasic Volos)
- [CVE-2026-62065](https://cve.now/CVE-2026-62065.md): WordPress Cardea theme \<= 2.3 - Local File Inclusion vulnerability (CVSS 8.1, CocoBasic Cardea)
- [CVE-2026-62064](https://cve.now/CVE-2026-62064.md): WordPress Ambed theme \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bracketweb Ambed)
- [CVE-2026-62054](https://cve.now/CVE-2026-62054.md): WordPress Yacht Rental theme \<= 2.6 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Yacht Rental)
- [CVE-2026-62053](https://cve.now/CVE-2026-62053.md): WordPress Wine House theme \<= 3.20 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Wine House)
- [CVE-2026-62052](https://cve.now/CVE-2026-62052.md): WordPress Tipsy theme \<= 1.6 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Tipsy)
- [CVE-2026-62051](https://cve.now/CVE-2026-62051.md): WordPress Stargaze theme \<= 1.10 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Stargaze)
- [CVE-2026-62050](https://cve.now/CVE-2026-62050.md): WordPress Splendour theme \<= 1.23 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Splendour)
- [CVE-2026-62043](https://cve.now/CVE-2026-62043.md): WordPress Contact Form 7 – Dynamic Text Extension plugin \<= 5.0.7 - Sensitive Data Exposure vulnerability (CVSS 7.5, sevenspark Contact Form 7 – Dynamic Text Extension)
- [CVE-2026-62038](https://cve.now/CVE-2026-62038.md): WordPress eRoom plugin \<= 1.7.1 - Broken Authentication vulnerability (CVSS 7.3, DigitalME eRoom)
- [CVE-2026-62037](https://cve.now/CVE-2026-62037.md): WordPress Document Embedder plugin \<= 2.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bPlugins Document Embedder)
- [CVE-2026-62035](https://cve.now/CVE-2026-62035.md): WordPress AWS S3 for WordPress Plugin – Upcasted plugin \<= 3.1.0 - Broken Access Control vulnerability (CVSS 6.3, AWS S3 for WordPress Plugin – Upcasted)
- [CVE-2026-62034](https://cve.now/CVE-2026-62034.md): WordPress Before After Image Comparison – Image comparison for WP plugin \<= 1.1.21 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bPlugins Before After Image Comparison – Image comparison f…)
- [CVE-2026-62033](https://cve.now/CVE-2026-62033.md): WordPress uListing plugin \<= 2.2.0 - Settings Change vulnerability (CVSS 7.6, Stylemix uListing)
- [CVE-2026-62032](https://cve.now/CVE-2026-62032.md): WordPress DirectoryPress plugin \<= 3.6.27 - Local File Inclusion vulnerability (CVSS 9.8, Designinvento DirectoryPress)
- [CVE-2026-62031](https://cve.now/CVE-2026-62031.md): WordPress uListing plugin \<= 2.2.0 - SQL Injection vulnerability (CVSS 9.3, Stylemix uListing)
- [CVE-2026-62030](https://cve.now/CVE-2026-62030.md): WordPress StreamCast plugin \<= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, bPlugins StreamCast)
- [CVE-2026-62027](https://cve.now/CVE-2026-62027.md): WordPress Team Section Block plugin \<= 2.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, bPlugins Team Section Block)
- [CVE-2026-62025](https://cve.now/CVE-2026-62025.md): WordPress Tailored Tools plugin \<= 3.0.3 - Arbitrary File Upload vulnerability (CVSS 9.0, Tailored Media Tailored Tools)
- [CVE-2026-62024](https://cve.now/CVE-2026-62024.md): WordPress CodeBard Help Desk plugin \<= 1.1.2 - Arbitrary File Upload vulnerability (CVSS 9.9, CodeBard Help Desk)
- [CVE-2026-62022](https://cve.now/CVE-2026-62022.md): WordPress Tonda Membership plugin \<= 1.0.1 - Privilege Escalation vulnerability (CVSS 9.8, Select-Themes Tonda Membership)
- [CVE-2026-62021](https://cve.now/CVE-2026-62021.md): WordPress Angio theme \<= 1.1.1 - PHP Object Injection vulnerability (CVSS 8.8, rascals Angio)
- [CVE-2026-62020](https://cve.now/CVE-2026-62020.md): WordPress TouchUp theme \< 1.4 - Local File Inclusion vulnerability (CVSS 8.1, Mikado-Themes TouchUp)
- [CVE-2026-48194](https://cve.now/CVE-2026-48194.md): WordPress DukaMarket theme \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 8.1, kutethemes DukaMarket)
- [CVE-2026-48193](https://cve.now/CVE-2026-48193.md): WordPress Uminex theme \<= 1.0.9 - Local File Inclusion vulnerability (CVSS 8.1, kutethemes Uminex)
- [CVE-2026-45440](https://cve.now/CVE-2026-45440.md): WordPress WP Ultimate CSV Importer plugin \<= 9.2 - SQL Injection vulnerability (CVSS 7.6, Smackcoders WP Ultimate CSV Importer)
- [CVE-2026-42777](https://cve.now/CVE-2026-42777.md): WordPress Aalto theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1, Edge-Themes Aalto)
- [CVE-2026-42724](https://cve.now/CVE-2026-42724.md): WordPress CleanSkin theme \<= 1.5.0 - Local File Inclusion vulnerability (CVSS 8.1, AncoraThemes CleanSkin)
- [CVE-2026-42723](https://cve.now/CVE-2026-42723.md): WordPress CleanSkin theme \<= 1.5.0 - PHP Object Injection vulnerability (CVSS 9.8, AncoraThemes CleanSkin)
- [CVE-2026-42722](https://cve.now/CVE-2026-42722.md): WordPress Frontend Admin by DynamiApps plugin \<= 3.29.13 - SQL Injection vulnerability (CVSS 7.6, Shabti Kaplan Frontend Admin by DynamiApps)
- [CVE-2026-42719](https://cve.now/CVE-2026-42719.md): WordPress Dynamic User Directory plugin \<= 2.4 - PHP Object Injection vulnerability (CVSS 9.8, Sarah Giles Dynamic User Directory)
- [CVE-2026-42718](https://cve.now/CVE-2026-42718.md): WordPress Booster for WooCommerce plugin \<= 8.4.0 - PHP Object Injection vulnerability (CVSS 9.8, Pluggabl Booster for WooCommerce)
- [CVE-2026-42717](https://cve.now/CVE-2026-42717.md): WordPress Leyka plugin \<= 3.32.3 - SQL Injection vulnerability (CVSS 7.6, VaultDweller Leyka)
- [CVE-2026-42716](https://cve.now/CVE-2026-42716.md): WordPress Payever - WooCommerce Gateway plugin \<= 4.8.2 - PHP Object Injection vulnerability (CVSS 9.8, Payever - WooCommerce Gateway)
- [CVE-2026-42715](https://cve.now/CVE-2026-42715.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.47 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Photo Gallery by 10Web)
- [CVE-2026-42712](https://cve.now/CVE-2026-42712.md): WordPress Qode Tours plugin \<= 3.1.3.2 - SQL Injection vulnerability (CVSS 8.5, Qode Tours)
- [CVE-2026-42711](https://cve.now/CVE-2026-42711.md): WordPress Slider by 10Web plugin \<= 1.2.63 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Slider by 10Web)
- [CVE-2026-42709](https://cve.now/CVE-2026-42709.md): WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin \<= 6.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, RadiusTheme Food Menu – Restaurant Menu & Online Ordering f…)
- [CVE-2026-42706](https://cve.now/CVE-2026-42706.md): WordPress DK theme \<= 3.2.1 - Broken Access Control vulnerability (CVSS 7.5, ThemeGoods DK)
- [CVE-2026-42705](https://cve.now/CVE-2026-42705.md): WordPress Grand News theme \<= 3.4 - Broken Access Control vulnerability (CVSS 7.5, ThemeGoods Grand News)
- [CVE-2026-42704](https://cve.now/CVE-2026-42704.md): WordPress Kids Care theme \<= 3.2.4 - Local File Inclusion vulnerability (CVSS 8.1, axiomthemes Kids Care)
- [CVE-2026-42702](https://cve.now/CVE-2026-42702.md): WordPress Tutor LMS plugin \<= 4.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Themeum Tutor LMS)
- [CVE-2026-42699](https://cve.now/CVE-2026-42699.md): WordPress FV Player 8 plugin \<= 8.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, FolioVision FV Player)
- [CVE-2026-42697](https://cve.now/CVE-2026-42697.md): WordPress Social Share Icons & Social Share Buttons plugin \<= 3.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Inisev Social Share Icons & Social Share Buttons)
- [CVE-2026-42696](https://cve.now/CVE-2026-42696.md): WordPress SiteVault – Backup, Restore, Migration & Cloning plugin \<= 1.5.18 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, Royal Plugins SiteVault – Backup, Restore, Migration &amp;…)
- [CVE-2026-42693](https://cve.now/CVE-2026-42693.md): WordPress Jannah theme \< 7.6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, TieLabs Jannah)
- [CVE-2026-42633](https://cve.now/CVE-2026-42633.md): WordPress Events Manager plugin \<= 7.4.6 - SQL Injection vulnerability (CVSS 8.5, Marcus Events Manager)
- [CVE-2026-42632](https://cve.now/CVE-2026-42632.md): WordPress Qode Real Estate plugin \<= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Qode Real Estate)
- [CVE-2026-42631](https://cve.now/CVE-2026-42631.md): WordPress Qode Music plugin \<= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Qode Music)
- [CVE-2026-42630](https://cve.now/CVE-2026-42630.md): WordPress Web Plura Backup & Restore Manager plugin \<= 0.2.25 - Sensitive Data Exposure vulnerability (CVSS 7.5, Web Plura Backup &amp; Restore Manager)
- [CVE-2026-42419](https://cve.now/CVE-2026-42419.md): WordPress Swish Migrate and Backup plugin \<= 1.4.0 - Sensitive Data Exposure vulnerability (CVSS 5.9, SwishFolio Swish Migrate and Backup)
- [CVE-2026-40808](https://cve.now/CVE-2026-40808.md): WordPress Jetpack VideoPress plugin \<= 3.6 - Broken Access Control vulnerability (CVSS 6.5, Automattic Jetpack VideoPress)
- [CVE-2026-40805](https://cve.now/CVE-2026-40805.md): WordPress PeepSo plugin \<= 9.0.5.4 - Arbitrary File Deletion vulnerability (CVSS 7.7, PeepSo)
- [CVE-2026-40803](https://cve.now/CVE-2026-40803.md): WordPress Jotform – AI Chatbot plugin \<= 3.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jotform &#8211; AI Chatbot)
- [CVE-2026-40802](https://cve.now/CVE-2026-40802.md): WordPress Pubjet | پاب‌جت plugin \<= 5.4.8 - Settings Change vulnerability (CVSS 7.6, Pubjet | پاب‌جت)
- [CVE-2026-40801](https://cve.now/CVE-2026-40801.md): WordPress Wordable plugin \<= 8.2.10 - Broken Access Control vulnerability (CVSS 8.1, Wordable)
- [CVE-2026-40800](https://cve.now/CVE-2026-40800.md): WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin \<= 1.5.3 - SQL Injection vulnerability (CVSS 9.3, ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products,…)
- [CVE-2026-40777](https://cve.now/CVE-2026-40777.md): WordPress WPSection plugin \<= 1.5.1 - Broken Access Control vulnerability (CVSS 8.1, Rashid WPSection)
- [CVE-2026-39802](https://cve.now/CVE-2026-39802.md): WordPress Everest Backup plugin \<= 2.3.13 - Remote Code Execution (RCE) vulnerability (CVSS 8.1, everestthemes Everest Backup)
- [CVE-2026-39801](https://cve.now/CVE-2026-39801.md): WordPress AIWU plugin \<= 1.5.9 - Privilege Escalation vulnerability (CVSS 9.8, Sergey AIWU)
- [CVE-2026-39800](https://cve.now/CVE-2026-39800.md): WordPress Additional Order Filters for WooCommerce plugin \<= 1.24 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Anton Bond Additional Order Filters for WooCommerce)
- [CVE-2026-39799](https://cve.now/CVE-2026-39799.md): WordPress WP File Download plugin \<= 6.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Joomunited WP File Download)
- [CVE-2026-108600](https://cve.now/CVE-2026-108600.md): open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file\_write Dangling Symlink (CVSS 5.7, open-multi-agent)
- [CVE-2026-108599](https://cve.now/CVE-2026-108599.md): Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass (CVSS 5.7, pulseaiclub phi)
- [CVE-2026-108598](https://cve.now/CVE-2026-108598.md): Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates (CVSS 9.3, floci-io floci)
- [CVE-2026-108597](https://cve.now/CVE-2026-108597.md): Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction (CVSS 5.9, cohere-ai cohere-python)
- [CVE-2026-108596](https://cve.now/CVE-2026-108596.md): OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header (CVSS 6.0, openlit)
- [CVE-2026-94590](https://cve.now/CVE-2026-94590.md): WordPress Sell Downloads plugin \<= 1.2.3 - Broken Access Control vulnerability (CVSS 6.5, CodePeople2 Sell Downloads)
- [CVE-2026-57806](https://cve.now/CVE-2026-57806.md): WordPress Martfury - WooCommerce Marketplace WordPress theme theme \<= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, drfuri Martfury - WooCommerce Marketplace WordPress Theme)
- [CVE-2026-108595](https://cve.now/CVE-2026-108595.md): Phi 0.3.0 through 0.28.4 Permission Bypass via agent\_spawn Workdir (CVSS 6.0, pulseaiclub phi)
- [CVE-2026-108594](https://cve.now/CVE-2026-108594.md): Mealie 3.26.0 through 3.28.0 SSRF via OIDC Picture Claim Avatar Fetch (CVSS 2.3, mealie-recipes mealie)
- [CVE-2026-108593](https://cve.now/CVE-2026-108593.md): 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint (CVSS 7.3, decolua 9router)
- [CVE-2026-108592](https://cve.now/CVE-2026-108592.md): mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment (CVSS 6.0, mini-swe-agent)
- [CVE-2026-108591](https://cve.now/CVE-2026-108591.md): InnoShop 0.9.2 Local File Disclosure via AI Core MCP file\_upload Tool (CVSS 5.9, innocommerce InnoShop)
- [CVE-2026-106610](https://cve.now/CVE-2026-106610.md): WordPress miniorange otp verification plugin \<= 5.5.7 - Privilege Escalation vulnerability (CVSS 9.8, miniorange otp verification)
- [CVE-2026-96341](https://cve.now/CVE-2026-96341.md): WordPress Forminator plugin \<= 1.57.3 - Privilege Escalation vulnerability (CVSS 8.2, WPMU DEV Forminator)
- [CVE-2026-105892](https://cve.now/CVE-2026-105892.md): WordPress rtMedia for WordPress, BuddyPress and bbPress plugin \<= 4.7.13 - Arbitrary File Deletion vulnerability (CVSS 9.8, rtCamp rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2026-104398](https://cve.now/CVE-2026-104398.md): WordPress AFFI – Affiliate Marketing for WooCommerce plugin \<= 1.0.10 - PHP Object Injection vulnerability (CVSS 9.8, VillaTheme AFFI – Affiliate Marketing for WooCommerce)
- [CVE-2026-105889](https://cve.now/CVE-2026-105889.md): WordPress Tickera plugin \<= 3.6.0.6 - SQL Injection vulnerability (CVSS 9.3, Tickera)
- [CVE-2026-103071](https://cve.now/CVE-2026-103071.md): WordPress Thank You Page Customizer for WooCommerce plugin \<= 1.2.3 - Content Injection vulnerability (CVSS 7.5, VillaTheme Thank You Page Customizer for WooCommerce)
- [CVE-2026-103357](https://cve.now/CVE-2026-103357.md): WordPress GIFT4U plugin \<= 1.1.3 - Broken Access Control vulnerability (CVSS 6.9, VillaTheme GIFT4U)
- [CVE-2026-106608](https://cve.now/CVE-2026-106608.md): WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability (CVSS 7.2, Automattic WooCommerce)
- [CVE-2026-106609](https://cve.now/CVE-2026-106609.md): WordPress Bayarcash WooCommerce plugin \<= 4.4.2 - Broken Access Control vulnerability (CVSS 7.5, Web Impian Bayarcash WooCommerce)
- [CVE-2026-94160](https://cve.now/CVE-2026-94160.md): WordPress ThemeStek Extras for LabtechCO Theme plugin \<= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeStek Extras for LabtechCO Theme)
- [CVE-2026-62044](https://cve.now/CVE-2026-62044.md): WordPress Super Video Player plugin \<= 1.8.13 - PHP Object Injection vulnerability (CVSS 7.2, bPlugins Super Video Player)
- [CVE-2026-108586](https://cve.now/CVE-2026-108586.md): 1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter (CVSS 5.3, 1mcp-app @1mcp/agent)
- [CVE-2026-108585](https://cve.now/CVE-2026-108585.md): argocd-mcp through 0.9.0 Path Traversal via delete\_application Tool (CVSS 5.3, argoproj-labs argocd-mcp)
- [CVE-2026-108583](https://cve.now/CVE-2026-108583.md): zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero\_add\_by\_url Tool (CVSS 2.3, 54yyyu zotero-mcp)
- [CVE-2026-108582](https://cve.now/CVE-2026-108582.md): GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store (CVSS 6.8, genspark-ai GenOffice)
- [CVE-2026-108581](https://cve.now/CVE-2026-108581.md): Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers (CVSS 7.1, TencentCloud Octop)
- [CVE-2026-108580](https://cve.now/CVE-2026-108580.md): AniWorld Downloader before 5.3.0 WebUI Login Brute Force via /login (CVSS 6.9, phoenixthrush AniWorld Downloader)
- [CVE-2026-108579](https://cve.now/CVE-2026-108579.md): OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export (CVSS 2.3, Openpanel-dev openpanel)
- [CVE-2026-108555](https://cve.now/CVE-2026-108555.md): PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header (CVSS 2.3, schlagmichdoch PairDrop)
- [CVE-2026-108554](https://cve.now/CVE-2026-108554.md): PDFMathTranslate through 1.9.11 SSRF via Gradio Web GUI Link Input (CVSS 6.9, PDFMathTranslate)
- [CVE-2026-108553](https://cve.now/CVE-2026-108553.md): OpenRefine through 3.10.1 CSRF to RCE via get-rows Command (CVSS 7.7, OpenRefine)
- [CVE-2026-108551](https://cve.now/CVE-2026-108551.md): openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates (CVSS 9.3, ferdikoomen openapi-typescript-codegen)
- [CVE-2026-108550](https://cve.now/CVE-2026-108550.md): SkillHub before 0.2.22 Account Takeover via Account Merge Flow (CVSS 8.7, iflytek skillhub)
- [CVE-2026-108549](https://cve.now/CVE-2026-108549.md): cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing (CVSS 9.2, chenhg5 cc-connect)
- [CVE-2026-108548](https://cve.now/CVE-2026-108548.md): AstronRPA through 1.1.6 Authentication Bypass via Arbitrary Bearer Token (CVSS 6.9, iflytek astron-rpa)
- [CVE-2026-108547](https://cve.now/CVE-2026-108547.md): AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var (CVSS 7.1, iflytek astron-rpa)
- [CVE-2026-108546](https://cve.now/CVE-2026-108546.md): Spotweb through 1.5.8 OS Command Injection via Spot Title in Runcommand Integration (CVSS 7.7, spotweb)
- [CVE-2026-108545](https://cve.now/CVE-2026-108545.md): SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing (CVSS 8.2, SillyTavern)
- [CVE-2026-108115](https://cve.now/CVE-2026-108115.md): Kortix Suna 0.10.7 before 0.13.52 SSRF Guard Bypass via IPv6 6to4 Addresses (CVSS 2.3, kortix-ai suna)
- [CVE-2026-108114](https://cve.now/CVE-2026-108114.md): Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions (CVSS 5.3, strapi)
- [CVE-2026-66435](https://cve.now/CVE-2026-66435.md): WordPress WP Rollback plugin \<= 3.1.2 - Sensitive Data Exposure vulnerability (CVSS 5.9, Devin Walker WP Rollback)
- [CVE-2026-97264](https://cve.now/CVE-2026-97264.md): WordPress WPAdverts plugin \<= 2.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Greg Winiarski WPAdverts)
- [CVE-2026-97263](https://cve.now/CVE-2026-97263.md): WordPress WPAdverts plugin \<= 2.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Greg Winiarski WPAdverts)
- [CVE-2026-94676](https://cve.now/CVE-2026-94676.md): WordPress Tainacan plugin \<= 1.3.0 - PHP Object Injection vulnerability (CVSS 7.2, Tainacan Community Tainacan)
- [CVE-2026-105885](https://cve.now/CVE-2026-105885.md): WordPress Slider by 10Web plugin \<= 1.2.62 - PHP Object Injection vulnerability (CVSS 8.8, Slider by 10Web)
- [CVE-2026-102388](https://cve.now/CVE-2026-102388.md): WordPress Forminator plugin \<= 1.57.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPMU DEV Forminator)
- [CVE-2026-108165](https://cve.now/CVE-2026-108165.md): Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata (CVSS 5.3, immich-app immich)
- [CVE-2026-108164](https://cve.now/CVE-2026-108164.md): Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route (CVSS 7.1, opensource-socialnetwork)
- [CVE-2026-108163](https://cve.now/CVE-2026-108163.md): Pingvin Share X before 1.22.0 Ineffective Authentication Rate Limiting via Throttler TTL (CVSS 6.9, smp46 pingvin-share-x)
- [CVE-2026-108162](https://cve.now/CVE-2026-108162.md): Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For (CVSS 6.9, smp46 pingvin-share-x)
- [CVE-2026-108161](https://cve.now/CVE-2026-108161.md): FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download (CVSS 7.7, fusionpbx)
- [CVE-2026-107794](https://cve.now/CVE-2026-107794.md): ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list (CVSS 7.5, ExtUtils-Typemaps-Default)
- [CVE-2013-10076](https://cve.now/CVE-2013-10076.md): ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list (CVSS 7.5, ExtUtils-Typemaps-Default)
- [CVE-2026-107373](https://cve.now/CVE-2026-107373.md): ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T\_STD\_STRING typemap may read the SV length before stringifying the argument (CVSS 9.1, ExtUtils-Typemaps-Default)
- [CVE-2026-103636](https://cve.now/CVE-2026-103636.md): Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch (CVSS 7.5, Apache Software Foundation Apache DataSketches)
- [CVE-2026-103635](https://cve.now/CVE-2026-103635.md): Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch (CVSS 9.1, Apache Software Foundation Apache DataSketches)
- [CVE-2026-103513](https://cve.now/CVE-2026-103513.md): Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch (CVSS 9.8, Apache Software Foundation Apache DataSketches)
- [CVE-2026-103501](https://cve.now/CVE-2026-103501.md): Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch (CVSS 9.8, Apache Software Foundation Apache DataSketches)
- [CVE-2026-106139](https://cve.now/CVE-2026-106139.md): Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue (CVSS 5.4, Progress Software Kendo UI for Vue)
- [CVE-2026-106138](https://cve.now/CVE-2026-106138.md): Cross-Site Scripting via Chart Tooltip in KendoReact (CVSS 5.4, Progress Software KendoReact)
- [CVE-2026-108506](https://cve.now/CVE-2026-108506.md): Unauthorized access vulnerability in ZTE Z80 Ultra product (CVSS 5.5, ZTE Z80 Ultra)
- [CVE-2026-108505](https://cve.now/CVE-2026-108505.md): Information disclosure vulnerability in ZTE Z80 Ultra product (CVSS 3.3, ZTE Z80 Ultra)
- [CVE-2026-107657](https://cve.now/CVE-2026-107657.md): HivePress \<= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form (CVSS 7.2, HivePress – Business Directory, Listings & Classified Ads P…)
- [CVE-2026-4791](https://cve.now/CVE-2026-4791.md): PeproDev Ultimate Profile Solutions \<= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute (CVSS 6.4, PeproDev Ultimate Profile Solutions)
- [CVE-2026-104722](https://cve.now/CVE-2026-104722.md): Listdom: AI-powered Business Directory with Classifieds Ads Listings \<= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix\[file\]' Parameter (CVSS 4.9, webilia Listdom: AI-powered Business Directory with Classif…)
- [CVE-2026-91136](https://cve.now/CVE-2026-91136.md): Divi Plus \<= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg\_image' Parameter (CVSS 7.5, Divi Essential Divi Plus)
- [CVE-2026-93951](https://cve.now/CVE-2026-93951.md): WordPress Zeinet theme \<= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Bracketweb Zeinet)
- [CVE-2026-103478](https://cve.now/CVE-2026-103478.md): Premium Packages \<= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout\[billing\]\[phone\]' Parameter (CVSS 6.4, codename065 Premium Packages – Sell Digital Products Secure…)
- [CVE-2026-93746](https://cve.now/CVE-2026-93746.md): WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels \<= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter (CVSS 7.5, WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…)
- [CVE-2026-97340](https://cve.now/CVE-2026-97340.md): Avada | Website Builder For WordPress & WooCommerce \<= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author\_facebook' User Profile Field (CVSS 6.4, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2026-102291](https://cve.now/CVE-2026-102291.md): Kirki – Freeform Page Builder, Website Builder & Customizer \<= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display\_name' (CVSS 5.4, themeum Kirki – Freeform Page Builder, Website Builder & Cu…)
- [CVE-2026-104759](https://cve.now/CVE-2026-104759.md): WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) \<= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id\_token Nonce Verification (CVSS 8.1, WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION)
- [CVE-2026-102774](https://cve.now/CVE-2026-102774.md): SureDash \<= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content (CVSS 6.4, brainstormforce SureDash – Community, Courses & Member Dash…)
- [CVE-2026-104728](https://cve.now/CVE-2026-104728.md): AutomatorWP \<= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp\_ajax\_automatorwp\_fluentform\_get\_forms AJAX Action (CVSS 4.3, rubengc AutomatorWP – No-Code Workflow Automation, Integrat…)
- [CVE-2026-96653](https://cve.now/CVE-2026-96653.md): WP Directory Kit \<= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display\_name' Profile Field (Second-Order) (CVSS 6.5, wpdirectorykit WP Directory Kit)
- [CVE-2026-100178](https://cve.now/CVE-2026-100178.md): WPAdverts \<= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts\_location' Parameter (CVSS 7.2, gwin WPAdverts – Classifieds Plugin)
- [CVE-2026-96765](https://cve.now/CVE-2026-96765.md): WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) \<= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id\_token' Parameter (iss / unique\_name JWT claims) (CVSS 7.2, WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION)
- [CVE-2026-97396](https://cve.now/CVE-2026-97396.md): Email Marketing for WordPress and WooCommerce \<= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint (CVSS 6.4, Email Marketing for WordPress and WooCommerce – Retainful)
- [CVE-2026-104803](https://cve.now/CVE-2026-104803.md): WPCOM Member \<= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback (CVSS 9.8, whyun WPCOM Member)
- [CVE-2026-101921](https://cve.now/CVE-2026-101921.md): WPForms \<= 2.0.2.1 - Reflected Cross-Site Scripting via 'query\_var' Smart Tag in iframe srcdoc Attribute (CVSS 4.7, smub WPForms – AI Form Builder for WordPress – Contact Form…)
- [CVE-2026-101920](https://cve.now/CVE-2026-101920.md): Molongui Authorship \<= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute (CVSS 7.2, Molongui Authorship – Author Boxes, Guest Authors & Co-Auth…)
- [CVE-2026-96662](https://cve.now/CVE-2026-96662.md): Appointment Booking Plugin \<= 5.7.2 - Unauthenticated SQL Injection via 'booking\[service\_id\]' Parameter (CVSS 7.5, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-100147](https://cve.now/CVE-2026-100147.md): FunnelKit \<= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing) (CVSS 7.2, teamfunnelkit FunnelKit – Funnel Builder for WooCommerce Ch…)
- [CVE-2026-96563](https://cve.now/CVE-2026-96563.md): Motors \<= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm\_f\_s' Parameter (CVSS 6.4, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2026-96278](https://cve.now/CVE-2026-96278.md): WP Photo Album Plus \<= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST\_URI Session History (CVSS 7.2, opajaap WP Photo Album Plus)
- [CVE-2026-108504](https://cve.now/CVE-2026-108504.md): Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product (CVSS 5.5, ZTE Z80 Ultra)
- [CVE-2026-62045](https://cve.now/CVE-2026-62045.md): WordPress Booklovers theme \<= 2.13.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Booklovers)
- [CVE-2026-62046](https://cve.now/CVE-2026-62046.md): WordPress Gutentype theme \<= 2.1.12 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Gutentype)
- [CVE-2026-93945](https://cve.now/CVE-2026-93945.md): WordPress Balance theme \<= 1.12.0 - PHP Object Injection vulnerability (CVSS 9.8, Axiomthemes Balance)
- [CVE-2026-93944](https://cve.now/CVE-2026-93944.md): WordPress Camelia theme \<= 1.2.15 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Camelia)
- [CVE-2026-93943](https://cve.now/CVE-2026-93943.md): WordPress Convex theme \<= 1.16.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Convex)
- [CVE-2026-93942](https://cve.now/CVE-2026-93942.md): WordPress Dwell theme \<= 1.16.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Dwell)
- [CVE-2026-93941](https://cve.now/CVE-2026-93941.md): WordPress Edema theme \<= 1.2.2.2 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Edema)
- [CVE-2026-93940](https://cve.now/CVE-2026-93940.md): WordPress Greeny theme \<= 2.10.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Greeny)
- [CVE-2026-93938](https://cve.now/CVE-2026-93938.md): WordPress Hogwords theme \<= 1.2.7 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Hogwords)
- [CVE-2026-93937](https://cve.now/CVE-2026-93937.md): WordPress Hygia theme \<= 1.21.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Hygia)
- [CVE-2026-93936](https://cve.now/CVE-2026-93936.md): WordPress IPharm theme \<= 1.2.4 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group IPharm)
- [CVE-2026-93935](https://cve.now/CVE-2026-93935.md): WordPress Let's Play theme \<= 1.1.15 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Let's Play)
- [CVE-2026-93934](https://cve.now/CVE-2026-93934.md): WordPress Partiso theme \<= 1.1.13 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Partiso)
- [CVE-2026-93933](https://cve.now/CVE-2026-93933.md): WordPress Rosalinda theme \<= 1.2.4 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Rosalinda)
- [CVE-2026-93932](https://cve.now/CVE-2026-93932.md): WordPress Smart Casa theme \<= 1.0.12 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Smart Casa)
- [CVE-2026-93931](https://cve.now/CVE-2026-93931.md): WordPress Smash theme \<= 1.12.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Smash)
- [CVE-2026-93930](https://cve.now/CVE-2026-93930.md): WordPress Tantra theme \<= 2.9.0 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Tantra)
- [CVE-2026-93929](https://cve.now/CVE-2026-93929.md): WordPress Travesia theme \<= 1.1.16 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Travesia)
- [CVE-2026-93927](https://cve.now/CVE-2026-93927.md): WordPress Veto theme \<= 1.6.0 - PHP Object Injection vulnerability (CVSS 9.8, Axiomthemes Veto)
- [CVE-2026-93950](https://cve.now/CVE-2026-93950.md): WordPress Motors theme \<= 1.4.108 - Broken Access Control vulnerability (CVSS 7.5, StylemixThemes Motors)
- [CVE-2026-93949](https://cve.now/CVE-2026-93949.md): WordPress Grocery Shopping Store theme \<= 1.3.3 - Broken Authentication vulnerability (CVSS 7.1, Omegathemes Grocery Shopping Store)
- [CVE-2026-106606](https://cve.now/CVE-2026-106606.md): WordPress YITH WooCommerce Affiliates plugin \<= 3.31.0 - PHP Object Injection vulnerability (CVSS 7.2, YITH WooCommerce Affiliates)
- [CVE-2026-108503](https://cve.now/CVE-2026-108503.md): Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product (CVSS 3.3, ZTE Z80 Ultra)
- [CVE-2026-103427](https://cve.now/CVE-2026-103427.md): Simple Membership \<= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field (CVSS 6.4, wpinsider-1 Simple Membership)
- [CVE-2026-96572](https://cve.now/CVE-2026-96572.md): WP Meteor Website Speed Optimization Addon \<= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (CVSS 7.2, aguidrevitch WP Meteor Website Speed Optimization Addon)
- [CVE-2026-104006](https://cve.now/CVE-2026-104006.md): SpeedyCache \<= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment\_author\_\* Cookie Check (CVSS 3.7, softaculous SpeedyCache – Cache, Optimization, Performance)
- [CVE-2026-3717](https://cve.now/CVE-2026-3717.md): CV Builder – Professional Resume Builder SaaS \<= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload (CVSS 5.3, bestwpdeveloper WP CV Builder)
- [CVE-2026-107742](https://cve.now/CVE-2026-107742.md): 10Web Booster \<= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name (CVSS 7.2, 10Web Booster – Website speed optimization, Cache & Page Sp…)
- [CVE-2026-100196](https://cve.now/CVE-2026-100196.md): LazyLoad Plugin \<= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, wp\_media LazyLoad Plugin – Lazy Load Images, Videos, and If…)
- [CVE-2026-102402](https://cve.now/CVE-2026-102402.md): Team \<= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp\_filter\_taxonomy' Post Meta via \[tlpteam\] Shortcode (CVSS 6.4, techlabpro1 Team – Team Members Showcase Plugin)
- [CVE-2026-6243](https://cve.now/CVE-2026-6243.md): Frontend Admin by DynamiApps \<= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content (CVSS 6.4, shabti Frontend Admin by DynamiApps)
- [CVE-2026-5725](https://cve.now/CVE-2026-5725.md): Favicon Rotator \<= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt\_' prefix (CVSS 6.1, archetyped Favicon Rotator)
- [CVE-2026-107712](https://cve.now/CVE-2026-107712.md): WP Booking System \<= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current\_month' Parameter (CVSS 6.5, murgroland WP Booking System – Booking Calendar)
- [CVE-2026-100161](https://cve.now/CVE-2026-100161.md): Photo Reviews for WooCommerce \<= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr\_image\_upload\_id' Parameter (CVSS 7.2, villatheme Photo Reviews for WooCommerce)
- [CVE-2026-94538](https://cve.now/CVE-2026-94538.md): WP File Download \<= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions (CVSS 8.1, JoomUnited WP File Download)
- [CVE-2026-104801](https://cve.now/CVE-2026-104801.md): PPOM \<= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom\[fields\]\[\<data\_name\>\]\[n\]\[org\]' Parameter (CVSS 9.1, themeisle PPOM – Product Addons & Custom Fields for WooComm…)
- [CVE-2026-103897](https://cve.now/CVE-2026-103897.md): Responsive Lightbox & Gallery \<= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute (CVSS 4.4, dfactory Responsive Lightbox & Gallery)
- [CVE-2026-89100](https://cve.now/CVE-2026-89100.md): Payment Plugins for Stripe WooCommerce \<= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment (CVSS 6.1, paymentplugins Payment Plugins for Stripe WooCommerce)
- [CVE-2026-12626](https://cve.now/CVE-2026-12626.md): Online Scheduling and Appointment Booking System \<= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter (CVSS 7.2, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-97348](https://cve.now/CVE-2026-97348.md): SiteOrigin Widgets Bundle \<= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via \[siteorigin\_widget\] Shortcode 'value' JSON Instance (design.colors LESS Variable) (CVSS 6.5, gpriday SiteOrigin Widgets Bundle)
- [CVE-2026-95684](https://cve.now/CVE-2026-95684.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments\[name\]' Parameter (CVSS 7.2, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-96840](https://cve.now/CVE-2026-96840.md): Post Grid Gutenberg Blocks \<= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display\_name User Field (CVSS 7.2, wpxpo Post Grid Gutenberg Blocks – PostX)
- [CVE-2026-96574](https://cve.now/CVE-2026-96574.md): User Frontend \<= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf\_payment\_method' Parameter (CVSS 6.4, wedevs User Frontend – Membership, User Registration, User…)
- [CVE-2026-15178](https://cve.now/CVE-2026-15178.md): Fluent Forms \<= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification (CVSS 5.4, wpmanageninja Fluent Forms – Customizable Contact Forms, Su…)
- [CVE-2026-96558](https://cve.now/CVE-2026-96558.md): Quiz and Survey Master (QSM) \<= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm\_hidden\_questions' Parameter (CVSS 7.2, expresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…)
- [CVE-2026-108502](https://cve.now/CVE-2026-108502.md): Information disclosure vulnerability in ZTE Z80 Ultra product (CVSS 3.3, ZTE Z80 Ultra)
- [CVE-2026-94257](https://cve.now/CVE-2026-94257.md): SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset (CVSS 8.1, SMS Alert)
- [CVE-2026-94256](https://cve.now/CVE-2026-94256.md): SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP (CVSS 8.1, SMS Alert)
- [CVE-2026-87781](https://cve.now/CVE-2026-87781.md): LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit\_id' Parameter (CVSS 8.6, LTL Freight Quotes)
- [CVE-2026-87780](https://cve.now/CVE-2026-87780.md): LTL Freight Quotes – Old Dominion Edition \< 4.2.19 - Unauthenticated Stored XSS via Shipping Rules (CVSS 8.8, LTL Freight Quotes)
- [CVE-2026-85571](https://cve.now/CVE-2026-85571.md): Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR (CVSS 6.5, Tutor LMS)
- [CVE-2026-107323](https://cve.now/CVE-2026-107323.md): Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS (CVSS 6.8, Gallery PhotoBlocks)
- [CVE-2026-107321](https://cve.now/CVE-2026-107321.md): W3 Total Cache \< 2.10.6 - Author+ Path Traversal via CDN Media Library Import (CVSS 5.4, W3 Total Cache)
- [CVE-2026-107120](https://cve.now/CVE-2026-107120.md): Contest Gallery \< 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN (CVSS 5.3, Contest Gallery)
- [CVE-2026-105995](https://cve.now/CVE-2026-105995.md): Booking Package \< 1.7.30 - Unauthenticated Booking Customer PII Disclosure (CVSS 5.3, Booking Package)
- [CVE-2026-105990](https://cve.now/CVE-2026-105990.md): Accept PayPal Payments Using Contact Form 7 \< 4.0.7 - Unauthenticated PII Disclosure via CSV Export (CVSS 5.3, Accept PayPal Payments using Contact Form)
- [CVE-2026-105989](https://cve.now/CVE-2026-105989.md): Accept PayPal Payments using Contact Form 7 \< 4.0.7 - Unauthenticated Transaction Status Forgery (CVSS 5.3, Accept PayPal Payments using Contact Form)
- [CVE-2026-105977](https://cve.now/CVE-2026-105977.md): Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg\_delete\_video\_thumbnail (CVSS 2.2, Portfolio Filter Gallery)
- [CVE-2026-105976](https://cve.now/CVE-2026-105976.md): Portfolio Filter Gallery \< 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions (CVSS 4.7, Portfolio Filter Gallery)
- [CVE-2026-104754](https://cve.now/CVE-2026-104754.md): Rank Math SEO \< 1.0.280 - Admin+ Stored XSS via Redirection Source URL (CVSS 3.5, Rank Math SEO)
- [CVE-2026-104753](https://cve.now/CVE-2026-104753.md): Rank Math SEO \< 1.0.280 - Admin+ SQLi via 'per\_page' Parameter (CVSS 4.1, Rank Math SEO)
- [CVE-2026-104752](https://cve.now/CVE-2026-104752.md): Rank Math SEO \< 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import (CVSS 7.2, Rank Math SEO)
- [CVE-2026-12054](https://cve.now/CVE-2026-12054.md): Download Manager \<= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter (CVSS 6.1, codename065 Download Manager)
- [CVE-2026-14335](https://cve.now/CVE-2026-14335.md): Easy Digital Downloads \<= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters (CVSS 7.2, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2026-17025](https://cve.now/CVE-2026-17025.md): Graphene \<= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields (CVSS 6.4, silverks Graphene)
- [CVE-2026-14882](https://cve.now/CVE-2026-14882.md): Brizy \<= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta (CVSS 6.4, themefusecom Brizy – Page Builder)
- [CVE-2026-103912](https://cve.now/CVE-2026-103912.md): JetFormBuilder \<= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query\_var' Dynamic Preset via data-jfb-macro / JFB\_FIELD:: Macro Renderer (CVSS 4.7, jetmonsters JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-103482](https://cve.now/CVE-2026-103482.md): Simple Newsletter Plugin \<= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin\_key Pivot (CVSS 5.4, picocodes Noptin – Newsletter, New Post Notifications & Ema…)
- [CVE-2026-14877](https://cve.now/CVE-2026-14877.md): Data Tables Generator by Supsystic \<= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute (CVSS 6.4, supsysticcom Data Tables Generator by Supsystic)
- [CVE-2026-93775](https://cve.now/CVE-2026-93775.md): Podlove Podcast Publisher \<= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook (CVSS 7.2, eteubert Podlove Podcast Publisher)
- [CVE-2026-97643](https://cve.now/CVE-2026-97643.md): GiveWP \<= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp\_campaign\_grid Shortcode Attributes (CVSS 6.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2026-104723](https://cve.now/CVE-2026-104723.md): LifterLMS \<= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data (CVSS 8.8, LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes)
- [CVE-2026-104762](https://cve.now/CVE-2026-104762.md): Kadence Blocks \<= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2026-96682](https://cve.now/CVE-2026-96682.md): Presto Player \<= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via \<presto-player\> Tag (CVSS 7.2, 2winfactor Presto Player)
- [CVE-2026-92975](https://cve.now/CVE-2026-92975.md): Groundhogg \<= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion (CVSS 8.1, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2026-104899](https://cve.now/CVE-2026-104899.md): GeoDirectory \<= 2.8.187 - Unauthenticated Local File Inclusion via 'design\_type' Parameter (CVSS 8.1, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-18558](https://cve.now/CVE-2026-18558.md): Embed Any Document \<= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode (CVSS 6.4, awsmin Embed Any Document – Embed PDF, Word, PowerPoint and…)
- [CVE-2026-77183](https://cve.now/CVE-2026-77183.md): FooSales \<= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create\_update\_customer REST Endpoint (CVSS 8.8, FooSales – Point of Sale (POS) for WooCommerce)
- [CVE-2026-91862](https://cve.now/CVE-2026-91862.md): Getwid \<= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points' (CVSS 6.4, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2026-94421](https://cve.now/CVE-2026-94421.md): Church Admin \<= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter (CVSS 6.4, andy\_moyle Church Admin)
- [CVE-2026-96667](https://cve.now/CVE-2026-96667.md): Real Estate Manager \<= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first\_name' Parameter (CVSS 7.2, rameez\_iqbal Real Estate Manager – Property Listing and Age…)
- [CVE-2026-94375](https://cve.now/CVE-2026-94375.md): Order Export & Order Import for WooCommerce \<= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get\_file\_path() (CVSS 5.3, webtoffee Order Export & Order Import for WooCommerce)
- [CVE-2026-103520](https://cve.now/CVE-2026-103520.md): HivePress \<= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format (CVSS 6.4, HivePress – Business Directory, Listings & Classified Ads P…)
- [CVE-2026-104763](https://cve.now/CVE-2026-104763.md): Post Export Import with Media \<= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file\_path' Parameter in media\_metadata.json (CVSS 4.9, wpazleen Post Export Import with Media)
- [CVE-2026-104725](https://cve.now/CVE-2026-104725.md): Groundhogg \<= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter (CVSS 8.8, trainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…)
- [CVE-2026-14379](https://cve.now/CVE-2026-14379.md): GamiPress \<= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video\_id' Parameter (CVSS 6.4, rubengc GamiPress – Gamification plugin to reward points, b…)
- [CVE-2026-16776](https://cve.now/CVE-2026-16776.md): MP3 Audio Player \<= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, MP3 Audio Player – Music Player, Podcast Player & Radio by…)
- [CVE-2026-83526](https://cve.now/CVE-2026-83526.md): FV Player 8 \<= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos\[\].fv\_wp\_flowplayer\_field\_src Parameter (CVSS 8.8, foliovision FV Player)
- [CVE-2026-104742](https://cve.now/CVE-2026-104742.md): AI Puffer \<= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax\_save\_semantic\_search\_settings AJAX action (CVSS 3.1, senols AI Puffer – AI Chatbot, AI Writer & Automation)
- [CVE-2026-104766](https://cve.now/CVE-2026-104766.md): Appointment Booking Plugin \<= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings\[default\_wp\_role\_for\_customer\]' Parameter (CVSS 8.8, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-104741](https://cve.now/CVE-2026-104741.md): AI Puffer \<= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax\_save\_cpt\_indexing\_options AJAX Endpoint (CVSS 3.1, senols AI Puffer – AI Chatbot, AI Writer & Automation)
- [CVE-2026-78068](https://cve.now/CVE-2026-78068.md): Table Field Add-on for ACF and SCF \<= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content (CVSS 6.4, jonua Table Field Add-on for ACF and SCF)
- [CVE-2026-104023](https://cve.now/CVE-2026-104023.md): Smart Popup by Supsystic \<= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter (CVSS 4.9, supsysticcom Smart Popup by Supsystic)
- [CVE-2026-18496](https://cve.now/CVE-2026-18496.md): Booking Calendar \<= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC\_FLEXTIMELINE\_NAV' AJAX Action (CVSS 5.3, wpdevelop Booking Calendar)
- [CVE-2026-91050](https://cve.now/CVE-2026-91050.md): Appointment Booking Plugin \<= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params\[presets\]\[order\_item\_id\]' Parameter (CVSS 4.3, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-89301](https://cve.now/CVE-2026-89301.md): rtMedia for WordPress, BuddyPress and bbPress \<= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files\[tmp\_name\]' Parameter (CVSS 7.5, rtcamp rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2026-97670](https://cve.now/CVE-2026-97670.md): Avada (Fusion) Builder \<= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action\_hook}' Dynamic-Data Token in Form Field (CVSS 9.1, themefusion Avada (Fusion) Builder)
- [CVE-2026-104021](https://cve.now/CVE-2026-104021.md): Fastcache by Host.it \<= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache\_cookie\_exclude' Setting (CVSS 7.2, hostspa Fastcache by Host.it)
- [CVE-2026-9696](https://cve.now/CVE-2026-9696.md): Download Manager \<= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm\_packages Shortcode (CVSS 6.4, codename065 Download Manager)
- [CVE-2026-104724](https://cve.now/CVE-2026-104724.md): FireBox \<= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition (CVSS 5.3, fireplugins FireBox – WooCommerce Popup Builder, Exit Inten…)
- [CVE-2026-103998](https://cve.now/CVE-2026-103998.md): Form Maker by 10Web \<= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key (CVSS 6.1, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-103424](https://cve.now/CVE-2026-103424.md): Anti-Spam by CleanTalk \<= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex (CVSS 5.4, Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA)
- [CVE-2026-6723](https://cve.now/CVE-2026-6723.md): Appointment Booking Calendar \<= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token (CVSS 5.3, croixhaug Simply Schedule Appointments)
- [CVE-2026-104735](https://cve.now/CVE-2026-104735.md): RSS Aggregator by Feedzy \<= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS \<title\> (CVSS 6.4, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2026-103964](https://cve.now/CVE-2026-103964.md): Download Manager \<= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first\_name' Profile Field Token Injection into Suspension Email (CVSS 4.3, codename065 Download Manager)
- [CVE-2026-87869](https://cve.now/CVE-2026-87869.md): Filter Everything — WordPress & WooCommerce Filters \<= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL (CVSS 6.1, stepasyuk Filter Everything — WordPress & WooCommerce Filte…)
- [CVE-2026-97630](https://cve.now/CVE-2026-97630.md): FV Flowplayer Video Player \<= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute (CVSS 6.4, foliovision FV Flowplayer Video Player)
- [CVE-2026-5727](https://cve.now/CVE-2026-5727.md): Hello Plus \<= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello\_plus\_set\_as\_entire\_site (CVSS 5.4, elemntor Hello Plus)
- [CVE-2026-102401](https://cve.now/CVE-2026-102401.md): Download Manager \<= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute (CVSS 6.4, codename065 Download Manager)
- [CVE-2026-101324](https://cve.now/CVE-2026-101324.md): Fluent Forms \<= 6.2.14 - Reflected Cross-Site Scripting via '{get.\*}' Editor SmartCode Parameter (CVSS 4.7, wpmanageninja Fluent Forms – Customizable Contact Forms, Su…)
- [CVE-2026-103889](https://cve.now/CVE-2026-103889.md): 3D Product configurator for WooCommerce \<= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv\_image' Parameter (CVSS 9.8, expivi 3D Product configurator for WooCommerce)
- [CVE-2026-104993](https://cve.now/CVE-2026-104993.md): GeoDirectory \<= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field (CVSS 6.4, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-96648](https://cve.now/CVE-2026-96648.md): Data Tables Generator by Supsystic \<= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action (CVSS 6.4, supsysticcom Data Tables Generator by Supsystic)
- [CVE-2026-108501](https://cve.now/CVE-2026-108501.md): Unauthorized access vulnerability in ZTE Z80 Ultra product (CVSS 5.7, ZTE Z80 Ultra)
- [CVE-2026-94589](https://cve.now/CVE-2026-94589.md): Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) \<= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload (CVSS 9.8, htplugins Extensions For CF7)
- [CVE-2026-103365](https://cve.now/CVE-2026-103365.md): Online Scheduling and Appointment Booking System \<= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly\_render\_details (CVSS 5.3, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-104732](https://cve.now/CVE-2026-104732.md): Advanced IP Blocker \<= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler (CVSS 9.8, inilerm Advanced IP Blocker)
- [CVE-2026-107645](https://cve.now/CVE-2026-107645.md): Blocksy Companion \<= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter (CVSS 9.1, creativethemeshq Blocksy Companion)
- [CVE-2026-104797](https://cve.now/CVE-2026-104797.md): Advanced Form Integration \<= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action (CVSS 8.1, nasirahmed Advanced Form Integration — Connect Forms to 300…)
- [CVE-2026-96743](https://cve.now/CVE-2026-96743.md): Table Field Add-on for ACF and SCF \<= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value (CVSS 6.4, jonua Table Field Add-on for ACF and SCF)
- [CVE-2026-104898](https://cve.now/CVE-2026-104898.md): Online Scheduling and Appointment Booking System \<= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp\_user\_id' Parameters via Query String / JSON Body (CVSS 6.8, ladela Online Scheduling and Appointment Booking System – B…)
- [CVE-2026-101947](https://cve.now/CVE-2026-101947.md): ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export (CVSS 8.4, CellHubs ExifTool for photo and video)
- [CVE-2026-104022](https://cve.now/CVE-2026-104022.md): Academy LMS \<= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add\_child REST endpoint (CVSS 5.4, kodezen Academy LMS – AI Course Builder, Quizzes, Certifica…)
- [CVE-2026-93883](https://cve.now/CVE-2026-93883.md): Advanced Classifieds & Directory Pro \<= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter (CVSS 6.4, pluginsware Advanced Classifieds & Directory Pro)
- [CVE-2026-104915](https://cve.now/CVE-2026-104915.md): Academy LMS \<= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete\_lesson\_comment AJAX — Attacker-Controlled course\_id vs. Target comment\_id (CVSS 6.5, kodezen Academy LMS – AI Course Builder, Quizzes, Certifica…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.