# CVEs published 2026-11-07

473 CVEs were published on November 7, 2026: 67 critical, 147 high. 2 early warnings were posted. Days are UTC.
## Early warnings

- [SZB-b6e6ae73e2](https://cve.now/SZB-b6e6ae73e2): Chainalysis says attack exposed credentials and live tokens for all customers
- [SZB-db26c70b7f](https://cve.now/SZB-db26c70b7f): Researchers find hundreds of public Artex AI pentest tool instances exposed online

## CVEs

- [CVE-2026-120531](https://cve.now/CVE-2026-120531.md): Subscribe2 – Form, Email Subscribers & Newsletters \<= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data\[ip\]' Parameter (CVSS 7.2, wedevs Subscribe2 – Form, Email Subscribers & Newsletters)
- [CVE-2026-99284](https://cve.now/CVE-2026-99284.md): net: skbuff: propagate shared-frag marker in skb\_zerocopy() (no CVSS, Linux)
- [CVE-2026-124060](https://cve.now/CVE-2026-124060.md): TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow (CVSS 9.4, TOTOLINK CA300-PoE)
- [CVE-2026-99283](https://cve.now/CVE-2026-99283.md): netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets (no CVSS, Linux)
- [CVE-2026-124059](https://cve.now/CVE-2026-124059.md): TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow (CVSS 9.4, TOTOLINK CA300-PoE)
- [CVE-2026-124058](https://cve.now/CVE-2026-124058.md): TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow (CVSS 9.4, TOTOLINK CA300-PoE)
- [CVE-2026-124057](https://cve.now/CVE-2026-124057.md): TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow (CVSS 9.4, TOTOLINK CA300-PoE)
- [CVE-2026-123472](https://cve.now/CVE-2026-123472.md): WordPress Meta Box – WordPress Custom Fields Framework plugin \<= 5.15.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, eLightUp Meta Box – WordPress Custom Fields Framework)
- [CVE-2026-119522](https://cve.now/CVE-2026-119522.md): WordPress User Registration plugin \<= 5.3.1 - Broken Access Control vulnerability (CVSS 5.3, ThemeGrill User Registration)
- [CVE-2026-123461](https://cve.now/CVE-2026-123461.md): WordPress FOX plugin \<= 1.5.6 - Broken Access Control vulnerability (CVSS 5.3, PluginUs.Net FOX)
- [CVE-2026-120836](https://cve.now/CVE-2026-120836.md): WordPress Meta Box – WordPress Custom Fields Framework plugin \<= 5.15.3 - Broken Access Control vulnerability (CVSS 6.5, eLightUp Meta Box – WordPress Custom Fields Framework)
- [CVE-2026-124258](https://cve.now/CVE-2026-124258.md): WordPress User Registration plugin \<= 5.3.1 - Broken Access Control vulnerability (CVSS 5.3, ThemeGrill User Registration)
- [CVE-2026-123992](https://cve.now/CVE-2026-123992.md): DataEase SVG StaticResourceServer.java StaticResourceServer.validateSvgContent cross site scripting (CVSS 5.3, DataEase)
- [CVE-2026-123991](https://cve.now/CVE-2026-123991.md): DataEase Authentication Filter WhitelistUtils.java WhitelistUtils.endsWithAny unrestricted upload (CVSS 6.9, DataEase)
- [CVE-2026-123990](https://cve.now/CVE-2026-123990.md): DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injection (CVSS 6.9, DataEase)
- [CVE-2026-123989](https://cve.now/CVE-2026-123989.md): ESEngine DeepSeek-Reasonix Build Script Execution build.rs loadGitStatus permission (CVSS 5.3, ESEngine DeepSeek-Reasonix)
- [CVE-2026-124318](https://cve.now/CVE-2026-124318.md): Treeio through 2.0 Insecure Deserialization RCE via Admin-Editable Pickle Fields (CVSS 8.6, treeio)
- [CVE-2026-124317](https://cve.now/CVE-2026-124317.md): libexpat through 2.10.0 Out-of-Bounds Read via unknown\_toUtf8 and unknown\_toUtf16 (CVSS 6.3, libexpat)
- [CVE-2026-124316](https://cve.now/CVE-2026-124316.md): Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get\_linked\_material\_requests (CVSS 5.3, frappe erpnext)
- [CVE-2026-124315](https://cve.now/CVE-2026-124315.md): Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get\_bom\_items (CVSS 7.1, frappe erpnext)
- [CVE-2026-124314](https://cve.now/CVE-2026-124314.md): Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get\_open\_activities (CVSS 7.1, frappe erpnext)
- [CVE-2026-124313](https://cve.now/CVE-2026-124313.md): Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get\_linked\_payments\_for\_doc (CVSS 5.3, frappe erpnext)
- [CVE-2026-124312](https://cve.now/CVE-2026-124312.md): Fraunhofer HHI VVdeC through 3.2.1 Heap Out-of-Bounds Read via CodingStructure::getColInfo (CVSS 5.7, fraunhoferhhi vvdec)
- [CVE-2026-124311](https://cve.now/CVE-2026-124311.md): Fraunhofer HHI VVdeC through 3.2.1 NULL Pointer Dereference via InterPrediction::xPredInterBlk (CVSS 6.8, fraunhoferhhi vvdec)
- [CVE-2026-124310](https://cve.now/CVE-2026-124310.md): Fraunhofer HHI VVdeC before 3.2.1 Out-of-Bounds Read via Slice::getRefPic (CVSS 6.9, fraunhoferhhi vvdec)
- [CVE-2026-124309](https://cve.now/CVE-2026-124309.md): Fraunhofer HHI VVdeC before 3.2.1 Heap Out-of-Bounds Read via SEIReader::xParseSEIScalableNesting (CVSS 6.9, fraunhoferhhi vvdec)
- [CVE-2026-124308](https://cve.now/CVE-2026-124308.md): Fraunhofer HHI VVdeC before 3.2.1 Use-After-Free via DecLibRecon::createSubPicRefBufs (CVSS 5.8, fraunhoferhhi vvdec)
- [CVE-2026-124307](https://cve.now/CVE-2026-124307.md): Fraunhofer HHI VVdeC before 3.2.1 Heap Use-After-Free via ALF APS Redefinition (CVSS 5.8, fraunhoferhhi vvdec)
- [CVE-2026-99282](https://cve.now/CVE-2026-99282.md): net/sched: sch\_teql: fix use-after-free on lower qdisc drop (no CVSS, Linux)
- [CVE-2026-99281](https://cve.now/CVE-2026-99281.md): tun: Require CAP\_NET\_ADMIN to attach to an ownerless device (no CVSS, Linux)
- [CVE-2026-99280](https://cve.now/CVE-2026-99280.md): ksmbd: drain session procfs readers before dropping table references (no CVSS, Linux)
- [CVE-2026-99279](https://cve.now/CVE-2026-99279.md): ksmbd: reclaim ended sessions on logoff and expiration (no CVSS, Linux)
- [CVE-2026-99278](https://cve.now/CVE-2026-99278.md): ksmbd: limit sessions on each connection (no CVSS, Linux)
- [CVE-2026-99277](https://cve.now/CVE-2026-99277.md): ksmbd: hold a connection reference for each session channel (no CVSS, Linux)
- [CVE-2026-99276](https://cve.now/CVE-2026-99276.md): ksmbd: defer connection scavenging while session locks are busy (no CVSS, Linux)
- [CVE-2026-99275](https://cve.now/CVE-2026-99275.md): smb: client: reject short SESSION\_SETUP responses (no CVSS, Linux)
- [CVE-2026-99274](https://cve.now/CVE-2026-99274.md): smb: client: fix fiemap wild read on empty truncated response (no CVSS, Linux)
- [CVE-2026-99273](https://cve.now/CVE-2026-99273.md): ksmbd: reserve space for the UTF-16 terminator in stream info (no CVSS, Linux)
- [CVE-2026-99272](https://cve.now/CVE-2026-99272.md): smb: client: validate the data area in SMB2\_read() (no CVSS, Linux)
- [CVE-2026-99271](https://cve.now/CVE-2026-99271.md): ALSA: line6: Clear prev\_fbuf on capture buffer release (no CVSS, Linux)
- [CVE-2026-123988](https://cve.now/CVE-2026-123988.md): SililaWijesinghe Food Ordering System admin exposure of information through directory listing (CVSS 6.9, SililaWijesinghe Food Ordering System)
- [CVE-2026-123966](https://cve.now/CVE-2026-123966.md): Tenda AC19 saveParentControlInfo heap-based overflow (CVSS 10.0, Tenda AC19)
- [CVE-2026-120984](https://cve.now/CVE-2026-120984.md): Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import (CVSS 9.1, Red Hat Build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-123860](https://cve.now/CVE-2026-123860.md): WordPress JetFormBuilder plugin \<= 3.6.8 - Content Injection vulnerability (CVSS 5.3, Crocoblock JetFormBuilder)
- [CVE-2026-123964](https://cve.now/CVE-2026-123964.md): OpenBMB Internet of Agents Collaboration Layer communication\_layer.py launch\_goal infinite loop (CVSS 5.3, OpenBMB Internet of Agents)
- [CVE-2026-123861](https://cve.now/CVE-2026-123861.md): WordPress JetFormBuilder – Hierarchical Select plugin \<= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, CrocoBlock JetFormBuilder – Hierarchical Select)
- [CVE-2026-120839](https://cve.now/CVE-2026-120839.md): WordPress WpTravelly plugin \<= 2.3.8 - Local File Inclusion vulnerability (CVSS 8.8, Magepeople WpTravelly)
- [CVE-2026-120841](https://cve.now/CVE-2026-120841.md): WordPress WpTravelly plugin \<= 2.3.8 - Local File Inclusion vulnerability (CVSS 8.8, Magepeople WpTravelly)
- [CVE-2026-121777](https://cve.now/CVE-2026-121777.md): WordPress Cool Formkit Lite plugin \<= 2.7.10 - Content Injection vulnerability (CVSS 5.3, Cool Plugins Cool Formkit Lite)
- [CVE-2026-123467](https://cve.now/CVE-2026-123467.md): WordPress Motors plugin \<= 1.4.128 - Broken Access Control vulnerability (CVSS 4.3, StylemixThemes Motors)
- [CVE-2026-122659](https://cve.now/CVE-2026-122659.md): WordPress Fluent Booking plugin \<= 2.5.0 - Broken Access Control vulnerability (CVSS 5.4, WP ManageNinja Fluent Booking)
- [CVE-2026-121579](https://cve.now/CVE-2026-121579.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin \<= 2.0.26 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Unlimited Elements For Elementor)
- [CVE-2026-121575](https://cve.now/CVE-2026-121575.md): WordPress WP User Manager plugin \<= 2.10.4 - Broken Access Control vulnerability (CVSS 5.3, WP User Manager)
- [CVE-2026-122660](https://cve.now/CVE-2026-122660.md): WordPress FloristPress plugin \<= 7.8.5 - Broken Access Control vulnerability (CVSS 4.3, BAKKBONE Australia FloristPress)
- [CVE-2026-123483](https://cve.now/CVE-2026-123483.md): WordPress JetFormBuilder plugin \<= 3.6.8 - Content Injection vulnerability (CVSS 5.3, Crocoblock JetFormBuilder)
- [CVE-2026-123183](https://cve.now/CVE-2026-123183.md): WordPress Active Products Tables for WooCommerce plugin \<= 2.1.6 - Content Injection vulnerability (CVSS 5.3, PluginUs.Net Active Products Tables for WooCommerce)
- [CVE-2026-123474](https://cve.now/CVE-2026-123474.md): WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin \<= 2.3.18 - Broken Access Control vulnerability (CVSS 5.3, LeapWorx Premium Blocks – Gutenberg Blocks for WordPress)
- [CVE-2026-121775](https://cve.now/CVE-2026-121775.md): WordPress CURCY plugin \<= 2.2.20 - Broken Access Control vulnerability (CVSS 5.3, VillaTheme CURCY)
- [CVE-2026-123462](https://cve.now/CVE-2026-123462.md): WordPress myCred plugin \<= 4.0.2 - Broken Access Control vulnerability (CVSS 5.3, myCred)
- [CVE-2026-122669](https://cve.now/CVE-2026-122669.md): WordPress Everest Forms plugin \<= 3.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Everest Forms)
- [CVE-2026-122663](https://cve.now/CVE-2026-122663.md): WordPress CURCY plugin \<= 2.2.20 - Broken Access Control vulnerability (CVSS 5.3, VillaTheme CURCY)
- [CVE-2026-121784](https://cve.now/CVE-2026-121784.md): WordPress WpBookingly plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Magepeople WpBookingly)
- [CVE-2026-123477](https://cve.now/CVE-2026-123477.md): WordPress JetEngine plugin \<= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetEngine)
- [CVE-2026-123963](https://cve.now/CVE-2026-123963.md): OpenBMB Internet of Agents Agent Registry app.py register missing authentication (CVSS 6.9, OpenBMB Internet of Agents)
- [CVE-2026-120579](https://cve.now/CVE-2026-120579.md): Active Woot Products Tables for WooCommerce. 100% FREE \<= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via… (CVSS 6.4, realmag777 Active Woot Products Tables for WooCommerce. 100…)
- [CVE-2026-109973](https://cve.now/CVE-2026-109973.md): Flipbox \<= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter (CVSS 6.4, oxilab Flipbox – Awesomes Flip Boxes Image Overlay)
- [CVE-2026-122041](https://cve.now/CVE-2026-122041.md): Checkout Field Editor for WooCommerce (Pro) \<= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via… (CVSS 9.1, Themehigh Checkout Field Editor for WooCommerce)
- [CVE-2026-119156](https://cve.now/CVE-2026-119156.md): Download Manager \<= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP\_Error-as-ID) via Spotlight Template… (CVSS 7.2, codename065 Download Manager)
- [CVE-2026-119498](https://cve.now/CVE-2026-119498.md): WordPress Simple Cloudflare Turnstile plugin \<= 1.44.4 - Broken Authentication vulnerability (CVSS 5.3, RelyWP Simple Cloudflare Turnstile)
- [CVE-2026-121765](https://cve.now/CVE-2026-121765.md): WordPress TranslatePress plugin \<= 3.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cozmoslabs TranslatePress)
- [CVE-2026-123776](https://cve.now/CVE-2026-123776.md): RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks… (no CVSS, RRD-CGI-Image)
- [CVE-2026-93429](https://cve.now/CVE-2026-93429.md): VikBooking Hotel Booking Engine & PMS \<= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests\[\]\[\]\[documents\]' Parameter (CVSS 7.2, e4jvikwp VikBooking Hotel Booking Engine & PMS)
- [CVE-2026-121977](https://cve.now/CVE-2026-121977.md): JetFormBuilder \<= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block \`to\_set\` Property (CVSS 5.4, jetmonsters JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-120509](https://cve.now/CVE-2026-120509.md): Real Testimonials \<= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro\_client\_name' Parameter (CVSS 4.7, shapedplugin Real Testimonials – Testimonial Slider, Collec…)
- [CVE-2026-115548](https://cve.now/CVE-2026-115548.md): Quttera ThreatSign \<= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header (CVSS 7.2, Quttera ThreatSign – Web Malware Scanner for WordPress)
- [CVE-2026-111317](https://cve.now/CVE-2026-111317.md): JetFormBuilder \<= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source (CVSS 7.2, jetmonsters JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-109214](https://cve.now/CVE-2026-109214.md): User Frontend \<= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input (CVSS 7.2, wedevs User Frontend – Membership, User Registration, User…)
- [CVE-2026-111370](https://cve.now/CVE-2026-111370.md): WP Visitor Statistics (Real Time Traffic) \<= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker… (CVSS 7.2, osamaesh WP Visitor Statistics)
- [CVE-2026-109991](https://cve.now/CVE-2026-109991.md): FunnelKit Payment Gateway for Stripe WooCommerce \<= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information… (CVSS 7.5, teamfunnelkit FunnelKit Payment Gateway for Stripe WooComme…)
- [CVE-2026-104014](https://cve.now/CVE-2026-104014.md): Naimur Email OTP Verification for WooCommerce \<= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password… (CVSS 9.8, naimurrahmannahid Naimur Email OTP Verification for WooComm…)
- [CVE-2026-118050](https://cve.now/CVE-2026-118050.md): Football Pool \<= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message (CVSS 6.4, antoineh Football Pool)
- [CVE-2026-118267](https://cve.now/CVE-2026-118267.md): WP Data Access \<= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update… (CVSS 8.1, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2026-123418](https://cve.now/CVE-2026-123418.md): Church Admin \<= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter (CVSS 7.2, andy\_moyle Church Admin)
- [CVE-2026-121976](https://cve.now/CVE-2026-121976.md): Modula Image Gallery \<= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter (CVSS 6.4, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2026-122231](https://cve.now/CVE-2026-122231.md): WS Form LITE \<= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value (CVSS 7.2, westguard WS Form LITE – Drag & Drop Contact Form Builder)
- [CVE-2026-120685](https://cve.now/CVE-2026-120685.md): Real Testimonials \<= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '\[gallery\]' Shortcode Chain (CVSS 5.4, shapedplugin Real Testimonials – Testimonial Slider, Collec…)
- [CVE-2026-109230](https://cve.now/CVE-2026-109230.md): WP Visitor Statistics (Real Time Traffic) \<= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter (CVSS 7.2, osamaesh WP Visitor Statistics)
- [CVE-2026-93766](https://cve.now/CVE-2026-93766.md): Happyforms Pro \<= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms\_client\_referer' Parameter (CVSS 7.2, Happyforms Pro)
- [CVE-2026-119075](https://cve.now/CVE-2026-119075.md): Registration Form for WooCommerce \<= 1.1.4 - Unauthenticated Privilege Escalation to 'user\_roles' Parameter at Checkout (CVSS 9.8, themegrill Registration Form for WooCommerce)
- [CVE-2026-104746](https://cve.now/CVE-2026-104746.md): Motors \<= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm\_user\_avatar\_path' User Meta (CVSS 8.1, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2026-104768](https://cve.now/CVE-2026-104768.md): AutomatorWP \<= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option (CVSS 7.5, rubengc AutomatorWP – No-Code Workflow Automation, Integrat…)
- [CVE-2026-120683](https://cve.now/CVE-2026-120683.md): Real Testimonials \<= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro\_client\_testimonial' Parameter (CVSS 5.4, shapedplugin Real Testimonials – Testimonial Slider, Collec…)
- [CVE-2026-104760](https://cve.now/CVE-2026-104760.md): weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot \<= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site… (CVSS 6.4, wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…)
- [CVE-2026-103914](https://cve.now/CVE-2026-103914.md): Dynific Addons for Elementor (formerly Anywhere Elementor) \<= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter (CVSS 6.5, wpvibes Dynific Addons for Elementor)
- [CVE-2026-119183](https://cve.now/CVE-2026-119183.md): JetFormBuilder \<= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta (CVSS 7.2, jetmonsters JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-96565](https://cve.now/CVE-2026-96565.md): WP-Members Membership Plugin \<= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout… (CVSS 6.4, cbutlerjr WP-Members Membership Plugin)
- [CVE-2026-116751](https://cve.now/CVE-2026-116751.md): Amelia Pro \<= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys (CVSS 7.5, Booking for Appointments and Events Calendar – Amelia Pro)
- [CVE-2026-118066](https://cve.now/CVE-2026-118066.md): Appointment Booking Plugin \<= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in… (CVSS 9.1, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-122059](https://cve.now/CVE-2026-122059.md): WP ImageViewer \<= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute (CVSS 6.4, mpol WP ImageViewer)
- [CVE-2026-118056](https://cve.now/CVE-2026-118056.md): Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) \<= 9.12.2 - Authenticated (Subscriber+) Stored… (CVSS 4.9, oxilab Image Hover Effects Ultimate)
- [CVE-2026-118047](https://cve.now/CVE-2026-118047.md): Falang multilanguage for WordPress \<= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang\_term\[\] via… (CVSS 6.4, sbouey Falang multilanguage for WordPress)
- [CVE-2026-116537](https://cve.now/CVE-2026-116537.md): Link Library \<= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link\_description' Parameter (CVSS 7.2, jackdewey Link Library)
- [CVE-2026-93755](https://cve.now/CVE-2026-93755.md): Happyforms Pro \<= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header (CVSS 7.2, Happyforms Pro)
- [CVE-2026-102564](https://cve.now/CVE-2026-102564.md): Dynific Addons for Elementor (formerly Anywhere Elementor) \<= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content… (CVSS 6.5, wpvibes Dynific Addons for Elementor)
- [CVE-2026-121265](https://cve.now/CVE-2026-121265.md): SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update (no CVSS, SQL-Abstract)
- [CVE-2026-121571](https://cve.now/CVE-2026-121571.md): WordPress Autopay dla WooCommerce plugin \<= 2.3.0 - Broken Access Control vulnerability (CVSS 5.3, WP Desk Autopay dla WooCommerce)
- [CVE-2026-119496](https://cve.now/CVE-2026-119496.md): WordPress Media LIbrary Assistant plugin \<= 3.43 - Content Injection vulnerability (CVSS 5.3, David Lingren Media LIbrary Assistant)
- [CVE-2026-123470](https://cve.now/CVE-2026-123470.md): WordPress HivePress plugin \<= 1.8.1 - Broken Access Control vulnerability (CVSS 4.3, HivePress)
- [CVE-2026-119513](https://cve.now/CVE-2026-119513.md): WordPress JS Help Desk plugin \<= 5.0.3 - Broken Access Control vulnerability (CVSS 5.3, Ahmad JS Help Desk)
- [CVE-2026-123468](https://cve.now/CVE-2026-123468.md): WordPress Motors plugin \<= 1.4.128 - Broken Access Control vulnerability (CVSS 4.3, StylemixThemes Motors)
- [CVE-2026-120857](https://cve.now/CVE-2026-120857.md): WordPress 2Way VideoCalls and Random Chat plugin \<= 6.1.9 - Broken Access Control vulnerability (CVSS 5.3, VideoWhisper.com 2Way VideoCalls and Random Chat)
- [CVE-2026-123148](https://cve.now/CVE-2026-123148.md): WordPress IvyForms plugin \<= 1.5.1 - Broken Access Control vulnerability (CVSS 5.3, TMS IvyForms)
- [CVE-2026-120837](https://cve.now/CVE-2026-120837.md): WordPress Everest Forms plugin \<= 3.6.3 - Broken Access Control vulnerability (CVSS 4.3, Everest Forms)
- [CVE-2026-121724](https://cve.now/CVE-2026-121724.md): WordPress Contextual Related Posts plugin \<= 4.5.3 - Broken Access Control vulnerability (CVSS 4.3, WebberZone Contextual Related Posts)
- [CVE-2026-120364](https://cve.now/CVE-2026-120364.md): WordPress Vidplex plugin \<= 1.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Untapwp Vidplex)
- [CVE-2026-119523](https://cve.now/CVE-2026-119523.md): WordPress Paid Member Subscriptions plugin \<= 3.1.3 - Broken Access Control vulnerability (CVSS 5.3, Cozmoslabs Paid Member Subscriptions)
- [CVE-2026-119525](https://cve.now/CVE-2026-119525.md): WordPress Dropshipping XML for WooCommerce plugin \<= 1.7.4 - Broken Access Control vulnerability (CVSS 4.3, WP Desk Dropshipping XML for WooCommerce)
- [CVE-2026-120365](https://cve.now/CVE-2026-120365.md): WordPress WP Customer Area plugin \<= 8.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aguila Technologies WP Customer Area)
- [CVE-2026-119478](https://cve.now/CVE-2026-119478.md): WordPress MasterStudy LMS plugin \<= 3.7.56 - Content Injection vulnerability (CVSS 4.3, StylemixThemes MasterStudy LMS)
- [CVE-2026-119508](https://cve.now/CVE-2026-119508.md): WordPress Radius Booking — Booking Calendar for Appointments &amp; Services plugin \<= 1.0.20 - Broken Access Control vulnerability (CVSS 5.3, Mamunur Rashid Radius Booking — Booking Calendar for Appoin…)
- [CVE-2026-119492](https://cve.now/CVE-2026-119492.md): WordPress Ditty plugin \<= 3.1.71 - Content Injection vulnerability (CVSS 4.3, Metaphor Creations Ditty)
- [CVE-2026-119501](https://cve.now/CVE-2026-119501.md): WordPress Element Pack Elementor Addons plugin \<= 10.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BdThemes Element Pack Elementor Addons)
- [CVE-2026-123961](https://cve.now/CVE-2026-123961.md): TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow (CVSS 9.4, TOTOLINK CA300-PoE)
- [CVE-2026-121783](https://cve.now/CVE-2026-121783.md): WordPress WP Data Access plugin \<= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, Passionate Programmer Peter WP Data Access)
- [CVE-2026-119490](https://cve.now/CVE-2026-119490.md): WordPress Better Notifications for WP plugin \<= 1.10.1 - Content Injection vulnerability (CVSS 5.3, Made with Fuel Better Notifications for WP)
- [CVE-2026-119486](https://cve.now/CVE-2026-119486.md): WordPress FluentBoards plugin \<= 2.2.2 - Broken Access Control vulnerability (CVSS 4.3, WP ManageNinja FluentBoards)
- [CVE-2026-119500](https://cve.now/CVE-2026-119500.md): WordPress Flash & HTML5 Video plugin \<= 2.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, bPlugins Flash & HTML5 Video)
- [CVE-2026-120840](https://cve.now/CVE-2026-120840.md): WordPress User Registration plugin \<= 5.3.0 - Broken Access Control vulnerability (CVSS 4.3, ThemeGrill User Registration)
- [CVE-2026-120842](https://cve.now/CVE-2026-120842.md): WordPress SureForms plugin \<= 2.13.0 - Broken Access Control vulnerability (CVSS 5.3, Brainstorm Force SureForms)
- [CVE-2026-119520](https://cve.now/CVE-2026-119520.md): WordPress Spectra plugin \<= 2.20.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm Force Spectra)
- [CVE-2026-119494](https://cve.now/CVE-2026-119494.md): WordPress Site Reviews plugin \<= 8.3.6 - Content Injection vulnerability (CVSS 5.3, Gemini Labs Site Reviews)
- [CVE-2026-120850](https://cve.now/CVE-2026-120850.md): WordPress Elementor Website Builder plugin \<= 4.3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Elementor Website Builder)
- [CVE-2026-119493](https://cve.now/CVE-2026-119493.md): WordPress Ditty plugin \<= 3.1.71 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Metaphor Creations Ditty)
- [CVE-2026-123960](https://cve.now/CVE-2026-123960.md): TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow (CVSS 9.4, TOTOLINK CA300-PoE)
- [CVE-2026-123959](https://cve.now/CVE-2026-123959.md): TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow (CVSS 9.4, TOTOLINK CA300-PoE)
- [CVE-2026-119507](https://cve.now/CVE-2026-119507.md): WordPress NotificationX plugin \<= 3.3.6 - Content Injection vulnerability (CVSS 5.3, WPDeveloper NotificationX)
- [CVE-2026-119473](https://cve.now/CVE-2026-119473.md): WordPress ProfilePress plugin \<= 4.17.7 - Content Injection vulnerability (CVSS 4.3, properfraction ProfilePress)
- [CVE-2026-119465](https://cve.now/CVE-2026-119465.md): WordPress Elementor Addon Elements plugin \<= 1.15 - Sensitive Data Exposure vulnerability (CVSS 5.3, WPVibes Elementor Addon Elements)
- [CVE-2026-121762](https://cve.now/CVE-2026-121762.md): WordPress PowerPress Podcasting plugin \<= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Blubrry Podcasting PowerPress Podcasting)
- [CVE-2026-107616](https://cve.now/CVE-2026-107616.md): Booking for Appointments and Events Calendar \<= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure… (CVSS 7.5, melograno Booking for Appointments and Events Calendar – Am…)
- [CVE-2026-120532](https://cve.now/CVE-2026-120532.md): wpForo Forum \<= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms (CVSS 6.4, tomdever wpForo Forum)
- [CVE-2026-95870](https://cve.now/CVE-2026-95870.md): wpForo Forum \<= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter (CVSS 7.5, tomdever wpForo Forum)
- [CVE-2026-119164](https://cve.now/CVE-2026-119164.md): wpForo Forum \<= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data\[secondary\_groupids\]' CSV Parameter (CVSS 7.5, tomdever wpForo Forum)
- [CVE-2026-103900](https://cve.now/CVE-2026-103900.md): WPJAM Basic \<= 7.1 - Unauthenticated Privilege Escalation to 'data\[args\]\[role\]' Parameter (CVSS 8.1, denishua WPJAM Basic)
- [CVE-2026-118784](https://cve.now/CVE-2026-118784.md): WPSpeed \<= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name (CVSS 6.4, john-dagelmore WPSpeed – WordPress Speed, Cache & Performan…)
- [CVE-2026-104992](https://cve.now/CVE-2026-104992.md): Booking for Appointments and Events Calendar \<= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure… (CVSS 6.5, melograno Booking for Appointments and Events Calendar – Am…)
- [CVE-2026-119155](https://cve.now/CVE-2026-119155.md): wpForo Forum \<= 3.2.2 - Unauthenticated SQL Injection via 'href\[locale\]' Parameter (CVSS 7.5, tomdever wpForo Forum)
- [CVE-2026-120548](https://cve.now/CVE-2026-120548.md): YML for Yandex Market \<= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym\_check\_action' Parameter via… (CVSS 5.3, icopydoc YML for Yandex Market)
- [CVE-2026-110004](https://cve.now/CVE-2026-110004.md): wpForo Forum \<= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter (CVSS 6.5, tomdever wpForo Forum)
- [CVE-2026-120514](https://cve.now/CVE-2026-120514.md): Zephyr Project Manager \<= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm\_profile\_picture' Parameter (CVSS 5.4, dylanjkotze Zephyr Project Manager)
- [CVE-2026-123464](https://cve.now/CVE-2026-123464.md): WordPress The Events Calendar plugin \<= 6.18.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Liquid Web / StellarWP The Events Calendar)
- [CVE-2026-119502](https://cve.now/CVE-2026-119502.md): WordPress Ultimate Store Kit Elementor Addons plugin \<= 4.0.1 - Broken Access Control vulnerability (CVSS 5.3, BdThemes Ultimate Store Kit Elementor Addons)
- [CVE-2026-122668](https://cve.now/CVE-2026-122668.md): WordPress myCred plugin \<= 4.0.2 - Broken Access Control vulnerability (CVSS 4.3, myCred)
- [CVE-2026-120853](https://cve.now/CVE-2026-120853.md): WordPress CartFlows plugin \<= 3.3.0 - Broken Access Control vulnerability (CVSS 5.3, Brainstorm Force CartFlows)
- [CVE-2026-120852](https://cve.now/CVE-2026-120852.md): WordPress CartFlows plugin \<= 3.3.0 - Content Injection vulnerability (CVSS 5.3, Brainstorm Force CartFlows)
- [CVE-2026-123469](https://cve.now/CVE-2026-123469.md): WordPress The Events Calendar plugin \<= 6.18.3 - Content Injection vulnerability (CVSS 5.3, Liquid Web / StellarWP The Events Calendar)
- [CVE-2026-119491](https://cve.now/CVE-2026-119491.md): WordPress Media LIbrary Assistant plugin \<= 3.43 - Broken Access Control vulnerability (CVSS 4.3, David Lingren Media LIbrary Assistant)
- [CVE-2026-61990](https://cve.now/CVE-2026-61990.md): WordPress WCFM Membership plugin \<= 2.12.0 - Broken Access Control vulnerability (CVSS 4.3, WC Lovers WCFM Membership)
- [CVE-2026-119484](https://cve.now/CVE-2026-119484.md): WordPress Photo Gallery by Supsystic plugin \<= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.3, Photo Gallery by Supsystic)
- [CVE-2026-120847](https://cve.now/CVE-2026-120847.md): WordPress Metform plugin \<= 4.3.3 - Broken Access Control vulnerability (CVSS 4.3, Wpmet Metform)
- [CVE-2026-119511](https://cve.now/CVE-2026-119511.md): WordPress MC Woocommerce Wishlist plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 5.3, Saeed MC Woocommerce Wishlist)
- [CVE-2026-121766](https://cve.now/CVE-2026-121766.md): WordPress PowerPress Podcasting plugin \<= 11.18.0 - Broken Access Control vulnerability (CVSS 5.4, Blubrry Podcasting PowerPress Podcasting)
- [CVE-2026-123466](https://cve.now/CVE-2026-123466.md): WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin \<= 2.3.18 - Broken Access Control vulnerability (CVSS 5.3, LeapWorx Premium Blocks – Gutenberg Blocks for WordPress)
- [CVE-2026-121768](https://cve.now/CVE-2026-121768.md): WordPress Contact Form 7 &#8211; Post Fields plugin \<= 2.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Markus Wiesenhofer Contact Form 7 &#8211; Post Fields)
- [CVE-2026-52713](https://cve.now/CVE-2026-52713.md): WordPress LearnPress plugin \<= 4.4.12 - Broken Access Control vulnerability (CVSS 5.4, ThimPress LearnPress)
- [CVE-2026-119467](https://cve.now/CVE-2026-119467.md): WordPress AnyWhere Elementor plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 5.4, WPVibes AnyWhere Elementor)
- [CVE-2026-66669](https://cve.now/CVE-2026-66669.md): WordPress Superb Addons: Blocks, Patterns &amp; theme Designer plugin \<= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8, Suplugins Superb Addons: Blocks, Patterns &amp; Theme Desig…)
- [CVE-2026-119510](https://cve.now/CVE-2026-119510.md): WordPress MC Woocommerce Wishlist plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saeed MC Woocommerce Wishlist)
- [CVE-2026-123958](https://cve.now/CVE-2026-123958.md): TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow (CVSS 9.4, TOTOLINK CA300-PoE)
- [CVE-2026-121781](https://cve.now/CVE-2026-121781.md): WordPress Fluent Booking plugin \<= 2.5.0 - Broken Access Control vulnerability (CVSS 5.3, WP ManageNinja Fluent Booking)
- [CVE-2026-119489](https://cve.now/CVE-2026-119489.md): WordPress WP Recipe Maker plugin \<= 10.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bootstrapped Ventures WP Recipe Maker)
- [CVE-2026-120849](https://cve.now/CVE-2026-120849.md): WordPress WCFM Marketplace plugin \<= 3.8.3 - Broken Access Control vulnerability (CVSS 4.3, WC Lovers WCFM Marketplace)
- [CVE-2026-120848](https://cve.now/CVE-2026-120848.md): WordPress WCFM Marketplace plugin \<= 3.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WC Lovers WCFM Marketplace)
- [CVE-2026-124274](https://cve.now/CVE-2026-124274.md): WordPress myCred plugin \<= 4.0.2 - Broken Access Control vulnerability (CVSS 5.3, myCred)
- [CVE-2026-122675](https://cve.now/CVE-2026-122675.md): WordPress Wp Social plugin \<= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, Wpmet Wp Social)
- [CVE-2026-121761](https://cve.now/CVE-2026-121761.md): WordPress VOD Infomaniak plugin \<= 1.5.15 - Broken Access Control vulnerability (CVSS 4.3, Infomaniak Network VOD Infomaniak)
- [CVE-2026-121767](https://cve.now/CVE-2026-121767.md): WordPress weDocs plugin \<= 2.6.1 - Broken Access Control vulnerability (CVSS 5.3, weDevs weDocs)
- [CVE-2026-121778](https://cve.now/CVE-2026-121778.md): WordPress WP-Lister Lite for Amazon plugin \<= 2.9.2 - Broken Access Control vulnerability (CVSS 5.3, WP Lab WP-Lister Lite for Amazon)
- [CVE-2026-121779](https://cve.now/CVE-2026-121779.md): WordPress YITH WooCommerce Subscription plugin \<= 4.22.0 - Sensitive Data Exposure vulnerability (CVSS 5.3, YITH WooCommerce Subscription)
- [CVE-2026-39733](https://cve.now/CVE-2026-39733.md): WordPress ProfilePress plugin \<= 4.17.7 - Content Injection vulnerability (CVSS 5.3, properfraction ProfilePress)
- [CVE-2026-104738](https://cve.now/CVE-2026-104738.md): Advanced Form Integration \<= 2.10.2 - Unauthenticated PHP Object Injection via $\_POST Parameters (CVSS 8.1, nasirahmed Advanced Form Integration — Connect Forms to 300…)
- [CVE-2026-123957](https://cve.now/CVE-2026-123957.md): TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow (CVSS 9.4, TOTOLINK CA300-PoE)
- [CVE-2026-123881](https://cve.now/CVE-2026-123881.md): OpenBMB Internet of Agents Message app.py fetch\_chat\_record access control (CVSS 6.9, OpenBMB Internet of Agents)
- [CVE-2026-118800](https://cve.now/CVE-2026-118800.md): aBlocks \<= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute (CVSS 6.4, kodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…)
- [CVE-2026-120537](https://cve.now/CVE-2026-120537.md): TranslatePress \<= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint (CVSS 7.2, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-115811](https://cve.now/CVE-2026-115811.md): Strong Testimonials \<= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star\_rating' Parameter (CVSS 7.2, wpchill Strong Testimonials)
- [CVE-2026-118801](https://cve.now/CVE-2026-118801.md): aBlocks \<= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks\_template' Shortcode (CVSS 4.3, kodezen aBlocks – Gutenberg Blocks, User Dashboard Builder,…)
- [CVE-2026-121792](https://cve.now/CVE-2026-121792.md): GamiPress \<= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter (CVSS 6.5, rubengc GamiPress – Gamification plugin to reward points, b…)
- [CVE-2026-120530](https://cve.now/CVE-2026-120530.md): WebToffee WP Backup and Migration \<= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography (CVSS 5.7, WebToffee WP Backup and Migration)
- [CVE-2026-120479](https://cve.now/CVE-2026-120479.md): WP Data Access \<= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project… (CVSS 6.4, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2026-122265](https://cve.now/CVE-2026-122265.md): Vanquish Upload Files for WooCommerce \<= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi\_file\_name' Parameter (CVSS 5.9, vanquish83 Vanquish Upload Files for WooCommerce)
- [CVE-2026-122037](https://cve.now/CVE-2026-122037.md): AgenWebsite Shipping \<= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup Wizard (CVSS 7.2, AgenWebsite Shipping – Plugin Ongkos Kirim & Generate Resi…)
- [CVE-2026-87112](https://cve.now/CVE-2026-87112.md): QA Assistants \<= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw\_name' and 'dlevent\_ver' Parameters (CVSS 8.8, quarka QA Assistants – Driven by data)
- [CVE-2026-118204](https://cve.now/CVE-2026-118204.md): WP Data Access \<= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Renderer (CVSS 6.4, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2026-121536](https://cve.now/CVE-2026-121536.md): WP Data Access \<= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameter (CVSS 5.3, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2026-93370](https://cve.now/CVE-2026-93370.md): Paystack WooCommerce Payment Gateway \<= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint (CVSS 5.3, Paystack WooCommerce Payment Gateway)
- [CVE-2026-116621](https://cve.now/CVE-2026-116621.md): Ultimate Member \<= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field (CVSS 6.4, ultimatemember Ultimate Member – User Profile, Registration…)
- [CVE-2026-118048](https://cve.now/CVE-2026-118048.md): WP Data Access \<= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label (CVSS 6.4, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2026-120515](https://cve.now/CVE-2026-120515.md): SEOPress \<= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress\_google\_analytics\_affiliate\_tracking' and… (CVSS 6.4, rainbowgeek SEOPress – AI SEO Plugin & On-site SEO)
- [CVE-2026-116558](https://cve.now/CVE-2026-116558.md): Unlimited Elements for Elementor \<= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget (CVSS 7.2, unitecms Unlimited Elements for Elementor)
- [CVE-2026-103917](https://cve.now/CVE-2026-103917.md): Quiz and Survey Master (QSM) \<= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm\_unique\_key' Parameter (CVSS 6.5, expresstech Quiz and Survey Master (QSM) – Quiz Maker & Sur…)
- [CVE-2026-83495](https://cve.now/CVE-2026-83495.md): Trainer: trainer: trainjob env passthrough enables valuefrom.secretkeyref injection for namespace secret exfiltration (no CVSS, Red Hat OpenShift AI)
- [CVE-2026-122001](https://cve.now/CVE-2026-122001.md): Komfortkasse for WooCommerce \< 1.4.9 - Administrator Account Creation via CSRF (CVSS 8.8, Komfortkasse for WooCommerce)
- [CVE-2026-121866](https://cve.now/CVE-2026-121866.md): Exsile SMS Gateway \< 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update (CVSS 8.8, iLeads SMS Gateway by Exsile)
- [CVE-2026-121858](https://cve.now/CVE-2026-121858.md): Event Tickets with Ticket Scanner \< 3.2.9 - Authenticated SQLi via DataTables Search (CVSS 6.3, Event Tickets with Ticket Scanner)
- [CVE-2026-121857](https://cve.now/CVE-2026-121857.md): Event Tickets with Ticket Scanner \< 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend (CVSS 4.2, Event Tickets with Ticket Scanner)
- [CVE-2026-121848](https://cve.now/CVE-2026-121848.md): Magic Link \< 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation (CVSS 8.8, Magic Link)
- [CVE-2026-121796](https://cve.now/CVE-2026-121796.md): Add From Server Reloaded \< 6.0.0 - Author+ Stored XSS via SVG Upload (CVSS 6.8, Add From Server Lite)
- [CVE-2026-121492](https://cve.now/CVE-2026-121492.md): Fiber Admin \< 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad\_cpo\_update and fiad\_cpo\_tax\_update (CVSS 5.3, Fiber Admin)
- [CVE-2026-121491](https://cve.now/CVE-2026-121491.md): Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header (CVSS 9.0, Fiber Admin)
- [CVE-2026-121380](https://cve.now/CVE-2026-121380.md): Tournamatch \< 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API (CVSS 5.3, Tournamatch)
- [CVE-2026-121379](https://cve.now/CVE-2026-121379.md): Tournamatch \< 4.7.1 - Subscriber+ Arbitrary File Deletion (CVSS 9.6, Tournamatch)
- [CVE-2026-119073](https://cve.now/CVE-2026-119073.md): Live Composer \< 2.1.23 - Contributor+ Stored XSS via Post Module Pagination (CVSS 6.8, Live Composer)
- [CVE-2026-118534](https://cve.now/CVE-2026-118534.md): Directorist \< 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR (CVSS 4.3, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-118533](https://cve.now/CVE-2026-118533.md): Directorist \< 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt (CVSS 4.3, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-118532](https://cve.now/CVE-2026-118532.md): Directorist \< 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field (CVSS 6.5, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-118530](https://cve.now/CVE-2026-118530.md): Directorist \< 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action (CVSS 5.0, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-118529](https://cve.now/CVE-2026-118529.md): Directorist \< 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout (CVSS 3.1, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-118528](https://cve.now/CVE-2026-118528.md): Directorist \< 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR (CVSS 4.3, Directorist: AI-Powered Business Directory, Listings & Clas…)
- [CVE-2026-117588](https://cve.now/CVE-2026-117588.md): WP Google Review Slider \< 18.11 - Google API Settings Update via CSRF (CVSS 4.3, WP Google Review Slider)
- [CVE-2026-117525](https://cve.now/CVE-2026-117525.md): FV Player \< 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup (CVSS 7.5, FV Flowplayer Video Player)
- [CVE-2025-15708](https://cve.now/CVE-2025-15708.md): Live Composer \< 2.1.23 - Admin+ Stored XSS via Partner Slug (CVSS 3.5, Live Composer)
- [CVE-2026-97191](https://cve.now/CVE-2026-97191.md): Advanced Custom Fields \< 6.8.11 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path (CVSS 2.7, Advanced Custom Fields)
- [CVE-2026-97190](https://cve.now/CVE-2026-97190.md): Advanced Custom Fields 6.2.0 - 6.8.10 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR (CVSS 2.7, Advanced Custom Fields)
- [CVE-2026-97189](https://cve.now/CVE-2026-97189.md): Advanced Custom Fields \< 6.8.11 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields (CVSS 2.7, Advanced Custom Fields)
- [CVE-2026-18535](https://cve.now/CVE-2026-18535.md): IBM API Connect Denial of Service (CVSS 9.6, IBM API Connect)
- [CVE-2026-19124](https://cve.now/CVE-2026-19124.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.8, IBM API Connect)
- [CVE-2026-17393](https://cve.now/CVE-2026-17393.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.1, IBM API Connect)
- [CVE-2026-17386](https://cve.now/CVE-2026-17386.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.1, IBM API Connect)
- [CVE-2026-17384](https://cve.now/CVE-2026-17384.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-75590](https://cve.now/CVE-2026-75590.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.2, IBM API Connect)
- [CVE-2026-19131](https://cve.now/CVE-2026-19131.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.5, IBM API Connect)
- [CVE-2026-19129](https://cve.now/CVE-2026-19129.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.8, IBM API Connect)
- [CVE-2026-19128](https://cve.now/CVE-2026-19128.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.5, IBM API Connect)
- [CVE-2026-19126](https://cve.now/CVE-2026-19126.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.9, IBM API Connect)
- [CVE-2026-19122](https://cve.now/CVE-2026-19122.md): Multiple Vulnerabilities in IBM API Connect (CVSS 3.8, IBM API Connect)
- [CVE-2026-19121](https://cve.now/CVE-2026-19121.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.3, IBM API Connect)
- [CVE-2026-18838](https://cve.now/CVE-2026-18838.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.4, IBM API Connect)
- [CVE-2026-18836](https://cve.now/CVE-2026-18836.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.3, IBM API Connect)
- [CVE-2026-18689](https://cve.now/CVE-2026-18689.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.3, IBM API Connect)
- [CVE-2026-17428](https://cve.now/CVE-2026-17428.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.0, IBM API Connect)
- [CVE-2026-17411](https://cve.now/CVE-2026-17411.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.6, IBM API Connect)
- [CVE-2026-17410](https://cve.now/CVE-2026-17410.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17409](https://cve.now/CVE-2026-17409.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.4, IBM API Connect)
- [CVE-2026-17408](https://cve.now/CVE-2026-17408.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.8, IBM API Connect)
- [CVE-2026-17407](https://cve.now/CVE-2026-17407.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17406](https://cve.now/CVE-2026-17406.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17405](https://cve.now/CVE-2026-17405.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.8, IBM API Connect)
- [CVE-2026-17404](https://cve.now/CVE-2026-17404.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17403](https://cve.now/CVE-2026-17403.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.0, IBM API Connect)
- [CVE-2026-17402](https://cve.now/CVE-2026-17402.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17401](https://cve.now/CVE-2026-17401.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.2, IBM API Connect)
- [CVE-2026-17400](https://cve.now/CVE-2026-17400.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17399](https://cve.now/CVE-2026-17399.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17398](https://cve.now/CVE-2026-17398.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17397](https://cve.now/CVE-2026-17397.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17396](https://cve.now/CVE-2026-17396.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.6, IBM API Connect)
- [CVE-2026-17395](https://cve.now/CVE-2026-17395.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17394](https://cve.now/CVE-2026-17394.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.6, IBM API Connect)
- [CVE-2026-17392](https://cve.now/CVE-2026-17392.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17391](https://cve.now/CVE-2026-17391.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.3, IBM API Connect)
- [CVE-2026-17390](https://cve.now/CVE-2026-17390.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17389](https://cve.now/CVE-2026-17389.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.3, IBM API Connect)
- [CVE-2026-17388](https://cve.now/CVE-2026-17388.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17387](https://cve.now/CVE-2026-17387.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17385](https://cve.now/CVE-2026-17385.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17383](https://cve.now/CVE-2026-17383.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17382](https://cve.now/CVE-2026-17382.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17381](https://cve.now/CVE-2026-17381.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17380](https://cve.now/CVE-2026-17380.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17379](https://cve.now/CVE-2026-17379.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.4, IBM API Connect)
- [CVE-2026-17378](https://cve.now/CVE-2026-17378.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17377](https://cve.now/CVE-2026-17377.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.0, IBM API Connect)
- [CVE-2026-17376](https://cve.now/CVE-2026-17376.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17375](https://cve.now/CVE-2026-17375.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17374](https://cve.now/CVE-2026-17374.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17373](https://cve.now/CVE-2026-17373.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17372](https://cve.now/CVE-2026-17372.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17371](https://cve.now/CVE-2026-17371.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.0, IBM API Connect)
- [CVE-2026-17370](https://cve.now/CVE-2026-17370.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17369](https://cve.now/CVE-2026-17369.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.4, IBM API Connect)
- [CVE-2026-17368](https://cve.now/CVE-2026-17368.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.8, IBM API Connect)
- [CVE-2026-17367](https://cve.now/CVE-2026-17367.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.4, IBM API Connect)
- [CVE-2026-17366](https://cve.now/CVE-2026-17366.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.0, IBM API Connect)
- [CVE-2026-17365](https://cve.now/CVE-2026-17365.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17363](https://cve.now/CVE-2026-17363.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17361](https://cve.now/CVE-2026-17361.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17360](https://cve.now/CVE-2026-17360.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.8, IBM API Connect)
- [CVE-2026-17359](https://cve.now/CVE-2026-17359.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17358](https://cve.now/CVE-2026-17358.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.2, IBM API Connect)
- [CVE-2026-17357](https://cve.now/CVE-2026-17357.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.6, IBM API Connect)
- [CVE-2026-17356](https://cve.now/CVE-2026-17356.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.7, IBM API Connect)
- [CVE-2026-17355](https://cve.now/CVE-2026-17355.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.2, IBM API Connect)
- [CVE-2026-17354](https://cve.now/CVE-2026-17354.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17353](https://cve.now/CVE-2026-17353.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.6, IBM API Connect)
- [CVE-2026-17352](https://cve.now/CVE-2026-17352.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17345](https://cve.now/CVE-2026-17345.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17344](https://cve.now/CVE-2026-17344.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.3, IBM API Connect)
- [CVE-2026-17343](https://cve.now/CVE-2026-17343.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.1, IBM API Connect)
- [CVE-2026-17342](https://cve.now/CVE-2026-17342.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17341](https://cve.now/CVE-2026-17341.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.2, IBM API Connect)
- [CVE-2026-17340](https://cve.now/CVE-2026-17340.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.8, IBM API Connect)
- [CVE-2026-17339](https://cve.now/CVE-2026-17339.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.1, IBM API Connect)
- [CVE-2026-17338](https://cve.now/CVE-2026-17338.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.1, IBM API Connect)
- [CVE-2026-17337](https://cve.now/CVE-2026-17337.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.4, IBM API Connect)
- [CVE-2026-17336](https://cve.now/CVE-2026-17336.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17335](https://cve.now/CVE-2026-17335.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.8, IBM API Connect)
- [CVE-2026-17334](https://cve.now/CVE-2026-17334.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17333](https://cve.now/CVE-2026-17333.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.0, IBM API Connect)
- [CVE-2026-17332](https://cve.now/CVE-2026-17332.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.7, IBM API Connect)
- [CVE-2026-17331](https://cve.now/CVE-2026-17331.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.5, IBM API Connect)
- [CVE-2026-17330](https://cve.now/CVE-2026-17330.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17329](https://cve.now/CVE-2026-17329.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.3, IBM API Connect)
- [CVE-2026-17328](https://cve.now/CVE-2026-17328.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17327](https://cve.now/CVE-2026-17327.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17326](https://cve.now/CVE-2026-17326.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.1, IBM API Connect)
- [CVE-2026-17325](https://cve.now/CVE-2026-17325.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17324](https://cve.now/CVE-2026-17324.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.3, IBM API Connect)
- [CVE-2026-17323](https://cve.now/CVE-2026-17323.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.2, IBM API Connect)
- [CVE-2026-17322](https://cve.now/CVE-2026-17322.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.1, IBM API Connect)
- [CVE-2026-17321](https://cve.now/CVE-2026-17321.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.1, IBM API Connect)
- [CVE-2026-17320](https://cve.now/CVE-2026-17320.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17319](https://cve.now/CVE-2026-17319.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.1, IBM API Connect)
- [CVE-2026-17318](https://cve.now/CVE-2026-17318.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17317](https://cve.now/CVE-2026-17317.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17316](https://cve.now/CVE-2026-17316.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.2, IBM API Connect)
- [CVE-2026-17315](https://cve.now/CVE-2026-17315.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.8, IBM API Connect)
- [CVE-2026-17314](https://cve.now/CVE-2026-17314.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.0, IBM API Connect)
- [CVE-2026-17313](https://cve.now/CVE-2026-17313.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.8, IBM API Connect)
- [CVE-2026-17312](https://cve.now/CVE-2026-17312.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.4, IBM API Connect)
- [CVE-2026-17311](https://cve.now/CVE-2026-17311.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.1, IBM API Connect)
- [CVE-2026-17310](https://cve.now/CVE-2026-17310.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.5, IBM API Connect)
- [CVE-2026-17309](https://cve.now/CVE-2026-17309.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.0, IBM API Connect)
- [CVE-2026-17308](https://cve.now/CVE-2026-17308.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.8, IBM API Connect)
- [CVE-2026-17307](https://cve.now/CVE-2026-17307.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.5, IBM API Connect)
- [CVE-2026-17306](https://cve.now/CVE-2026-17306.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.8, IBM API Connect)
- [CVE-2026-17305](https://cve.now/CVE-2026-17305.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.5, IBM API Connect)
- [CVE-2026-17304](https://cve.now/CVE-2026-17304.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17303](https://cve.now/CVE-2026-17303.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17302](https://cve.now/CVE-2026-17302.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.0, IBM API Connect)
- [CVE-2026-17301](https://cve.now/CVE-2026-17301.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.8, IBM API Connect)
- [CVE-2026-17299](https://cve.now/CVE-2026-17299.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.6, IBM API Connect)
- [CVE-2026-17298](https://cve.now/CVE-2026-17298.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17297](https://cve.now/CVE-2026-17297.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.6, IBM API Connect)
- [CVE-2026-17296](https://cve.now/CVE-2026-17296.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.6, IBM API Connect)
- [CVE-2026-17295](https://cve.now/CVE-2026-17295.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17294](https://cve.now/CVE-2026-17294.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17293](https://cve.now/CVE-2026-17293.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17292](https://cve.now/CVE-2026-17292.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.1, IBM API Connect)
- [CVE-2026-17291](https://cve.now/CVE-2026-17291.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.7, IBM API Connect)
- [CVE-2026-17290](https://cve.now/CVE-2026-17290.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17289](https://cve.now/CVE-2026-17289.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17288](https://cve.now/CVE-2026-17288.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17287](https://cve.now/CVE-2026-17287.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17285](https://cve.now/CVE-2026-17285.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17284](https://cve.now/CVE-2026-17284.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.1, IBM API Connect)
- [CVE-2026-17283](https://cve.now/CVE-2026-17283.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17282](https://cve.now/CVE-2026-17282.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17281](https://cve.now/CVE-2026-17281.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17280](https://cve.now/CVE-2026-17280.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.9, IBM API Connect)
- [CVE-2026-17279](https://cve.now/CVE-2026-17279.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17278](https://cve.now/CVE-2026-17278.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.8, IBM API Connect)
- [CVE-2026-17244](https://cve.now/CVE-2026-17244.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.4, IBM API Connect)
- [CVE-2026-17241](https://cve.now/CVE-2026-17241.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.5, IBM API Connect)
- [CVE-2026-17240](https://cve.now/CVE-2026-17240.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.5, IBM API Connect)
- [CVE-2026-17239](https://cve.now/CVE-2026-17239.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17238](https://cve.now/CVE-2026-17238.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17237](https://cve.now/CVE-2026-17237.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17236](https://cve.now/CVE-2026-17236.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17233](https://cve.now/CVE-2026-17233.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.4, IBM API Connect)
- [CVE-2026-17232](https://cve.now/CVE-2026-17232.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.1, IBM API Connect)
- [CVE-2026-17231](https://cve.now/CVE-2026-17231.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.8, IBM API Connect)
- [CVE-2026-17230](https://cve.now/CVE-2026-17230.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.4, IBM API Connect)
- [CVE-2026-17228](https://cve.now/CVE-2026-17228.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17225](https://cve.now/CVE-2026-17225.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.4, IBM API Connect)
- [CVE-2026-17215](https://cve.now/CVE-2026-17215.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.3, IBM API Connect)
- [CVE-2026-17214](https://cve.now/CVE-2026-17214.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.8, IBM API Connect)
- [CVE-2026-17211](https://cve.now/CVE-2026-17211.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.3, IBM API Connect)
- [CVE-2026-17202](https://cve.now/CVE-2026-17202.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.3, IBM API Connect)
- [CVE-2026-17190](https://cve.now/CVE-2026-17190.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.7, IBM API Connect)
- [CVE-2026-17188](https://cve.now/CVE-2026-17188.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17187](https://cve.now/CVE-2026-17187.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17172](https://cve.now/CVE-2026-17172.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17167](https://cve.now/CVE-2026-17167.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.3, IBM API Connect)
- [CVE-2026-17158](https://cve.now/CVE-2026-17158.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17155](https://cve.now/CVE-2026-17155.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.4, IBM API Connect)
- [CVE-2026-17154](https://cve.now/CVE-2026-17154.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.4, IBM API Connect)
- [CVE-2026-17150](https://cve.now/CVE-2026-17150.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17147](https://cve.now/CVE-2026-17147.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17146](https://cve.now/CVE-2026-17146.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17144](https://cve.now/CVE-2026-17144.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.3, IBM API Connect)
- [CVE-2026-17143](https://cve.now/CVE-2026-17143.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.3, IBM API Connect)
- [CVE-2026-17140](https://cve.now/CVE-2026-17140.md): Multiple Vulnerabilities in IBM API Connect (CVSS 3.3, IBM API Connect)
- [CVE-2026-17139](https://cve.now/CVE-2026-17139.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.4, IBM API Connect)
- [CVE-2026-17137](https://cve.now/CVE-2026-17137.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.0, IBM API Connect)
- [CVE-2026-17134](https://cve.now/CVE-2026-17134.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17132](https://cve.now/CVE-2026-17132.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17131](https://cve.now/CVE-2026-17131.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.3, IBM API Connect)
- [CVE-2026-17129](https://cve.now/CVE-2026-17129.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.6, IBM API Connect)
- [CVE-2026-17128](https://cve.now/CVE-2026-17128.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.8, IBM API Connect)
- [CVE-2026-17117](https://cve.now/CVE-2026-17117.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-17114](https://cve.now/CVE-2026-17114.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.4, IBM API Connect)
- [CVE-2026-17112](https://cve.now/CVE-2026-17112.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-17108](https://cve.now/CVE-2026-17108.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-17098](https://cve.now/CVE-2026-17098.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.3, IBM API Connect)
- [CVE-2026-17085](https://cve.now/CVE-2026-17085.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.1, IBM API Connect)
- [CVE-2026-17067](https://cve.now/CVE-2026-17067.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.5, IBM API Connect)
- [CVE-2026-17066](https://cve.now/CVE-2026-17066.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.1, IBM API Connect)
- [CVE-2026-17064](https://cve.now/CVE-2026-17064.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.0, IBM API Connect)
- [CVE-2026-17062](https://cve.now/CVE-2026-17062.md): Multiple Vulnerabilities in IBM API Connect (CVSS 2.7, IBM API Connect)
- [CVE-2026-17049](https://cve.now/CVE-2026-17049.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-16920](https://cve.now/CVE-2026-16920.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-16918](https://cve.now/CVE-2026-16918.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.3, IBM API Connect)
- [CVE-2026-16912](https://cve.now/CVE-2026-16912.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-16884](https://cve.now/CVE-2026-16884.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.9, IBM API Connect)
- [CVE-2026-16880](https://cve.now/CVE-2026-16880.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.5, IBM API Connect)
- [CVE-2026-16854](https://cve.now/CVE-2026-16854.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-16720](https://cve.now/CVE-2026-16720.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.8, IBM API Connect)
- [CVE-2026-16719](https://cve.now/CVE-2026-16719.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.5, IBM API Connect)
- [CVE-2026-16718](https://cve.now/CVE-2026-16718.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-16717](https://cve.now/CVE-2026-16717.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-16716](https://cve.now/CVE-2026-16716.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.8, IBM API Connect)
- [CVE-2026-16715](https://cve.now/CVE-2026-16715.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-16714](https://cve.now/CVE-2026-16714.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.5, IBM API Connect)
- [CVE-2026-16712](https://cve.now/CVE-2026-16712.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.7, IBM API Connect)
- [CVE-2026-16711](https://cve.now/CVE-2026-16711.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.3, IBM API Connect)
- [CVE-2026-16710](https://cve.now/CVE-2026-16710.md): Multiple Vulnerabilities in IBM API Connect (CVSS 5.8, IBM API Connect)
- [CVE-2026-16709](https://cve.now/CVE-2026-16709.md): Multiple Vulnerabilities in IBM API Connect (CVSS 8.7, IBM API Connect)
- [CVE-2026-16679](https://cve.now/CVE-2026-16679.md): IBM API Connect Path Traversal (CVSS 4.3, IBM API Connect)
- [CVE-2026-108178](https://cve.now/CVE-2026-108178.md): Multiple Vulnerabilities in IBM API Connect (CVSS 4.2, IBM API Connect)
- [CVE-2026-105459](https://cve.now/CVE-2026-105459.md): Multiple Vulnerabilities in IBM API Connect (CVSS 6.8, IBM API Connect)
- [CVE-2026-105002](https://cve.now/CVE-2026-105002.md): Multiple Vulnerabilities in IBM API Connect (CVSS 7.5, IBM API Connect)
- [CVE-2026-110534](https://cve.now/CVE-2026-110534.md): Redux Framework \<= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name (CVSS 6.4, davidanderson Redux Framework)
- [CVE-2026-120043](https://cve.now/CVE-2026-120043.md): Affiliate Program Suite \<= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter (CVSS 7.5, iovamihai Affiliate Program Suite — SliceWP Affiliates)
- [CVE-2026-93779](https://cve.now/CVE-2026-93779.md): Tutor LMS \<= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints (CVSS 6.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-119167](https://cve.now/CVE-2026-119167.md): TranslatePress \<= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE… (CVSS 7.2, cozmoslabs TranslatePress – Translate Multilingual sites wi…)
- [CVE-2026-110705](https://cve.now/CVE-2026-110705.md): Redux Framework \<= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download\_options… (CVSS 5.3, davidanderson Redux Framework)
- [CVE-2026-120477](https://cve.now/CVE-2026-120477.md): Stop Spammers Classic \<= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter (CVSS 4.7, webguyio Stop Spammers Classic)
- [CVE-2026-9601](https://cve.now/CVE-2026-9601.md): Stackable \<= 3.19.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameter (CVSS 6.4, bfintal Stackable – Page Builder Gutenberg Blocks)
- [CVE-2026-93902](https://cve.now/CVE-2026-93902.md): Soledad \<= 8.7.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Social Profile Fields (CVSS 6.4, pencidesign Soledad)
- [CVE-2026-123218](https://cve.now/CVE-2026-123218.md): IBM Aspera Faspex Authorization Bypass (CVSS 9.8, IBM Aspera Faspex)
- [CVE-2026-121516](https://cve.now/CVE-2026-121516.md): QODE Wishlist for WooCommerce \<= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table\_title' Shared Wishlist Field via Guest… (CVSS 6.1, qodeinteractive QODE Wishlist for WooCommerce)
- [CVE-2026-120677](https://cve.now/CVE-2026-120677.md): Optimole \<= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, Optimole – Optimize Images | Convert WebP & AVIF | CDN & La…)
- [CVE-2026-119158](https://cve.now/CVE-2026-119158.md): Pie Register \<= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first\_name' Parameter via Comment Avatar (CVSS 7.2, genetechproducts Pie Register – User Registration, Profiles…)
- [CVE-2026-120560](https://cve.now/CVE-2026-120560.md): Active Woot Products Tables for WooCommerce. 100% FREE \<= 2.1.5 - Unauthenticated File Deletion via 'wp\_columns\_actions' and 'table\_id'… (CVSS 6.5, realmag777 Active Woot Products Tables for WooCommerce. 100…)
- [CVE-2026-120739](https://cve.now/CVE-2026-120739.md): Optimole \<= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor (CVSS 7.2, Optimole – Optimize Images | Convert WebP & AVIF | CDN & La…)
- [CVE-2026-19803](https://cve.now/CVE-2026-19803.md): Printcart Store \<= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu\_crop\_image 'url' Parameter (CVSS 9.8, Printcart Store – Web to Print Product Designer for WooComm…)
- [CVE-2026-17362](https://cve.now/CVE-2026-17362.md): Multiple Vulnerabilities in IBM API Connect (CVSS 9.8, IBM API Connect)
- [CVE-2026-120540](https://cve.now/CVE-2026-120540.md): iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more \<= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment… (CVSS 7.2, iubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…)
- [CVE-2026-119218](https://cve.now/CVE-2026-119218.md): Greenshift \<= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute… (CVSS 5.4, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2026-120741](https://cve.now/CVE-2026-120741.md): MotoPress Appointment Booking \<= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint (CVSS 5.4, jetmonsters MotoPress Appointment Booking)
- [CVE-2026-115816](https://cve.now/CVE-2026-115816.md): Kubio AI Page Builder \<= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review (CVSS 6.4, extendthemes Kubio AI Page Builder)
- [CVE-2026-119175](https://cve.now/CVE-2026-119175.md): Flying Images: Optimize and Lazy Load Images for Faster Page Speed \<= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment… (CVSS 7.2, gijo Flying Images: Optimize and Lazy Load Images for Faste…)
- [CVE-2026-121515](https://cve.now/CVE-2026-121515.md): FV Flowplayer Video Player \<= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 5.4, foliovision FV Flowplayer Video Player)
- [CVE-2026-104913](https://cve.now/CVE-2026-104913.md): Interactive Real Estate \<= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image\_map.json (CVSS 8.8, esaia Interactive Real Estate – Floor Plan & Building Visua…)
- [CVE-2026-118067](https://cve.now/CVE-2026-118067.md): Form Maker by 10Web \<= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled\_fields Parameter (CVSS 5.4, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2026-119165](https://cve.now/CVE-2026-119165.md): WPBakery Page Builder \<= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name (CVSS 6.4, WPBakery Page Builder)
- [CVE-2026-119152](https://cve.now/CVE-2026-119152.md): Appointment Booking Plugin \<= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field (CVSS 5.4, Appointment Booking Plugin – LatePoint | Calendar & Schedul…)
- [CVE-2026-119213](https://cve.now/CVE-2026-119213.md): Fluent Support \<= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed (CVSS 3.7, wpmanageninja Fluent Support – Helpdesk & Customer Support…)
- [CVE-2026-119098](https://cve.now/CVE-2026-119098.md): LifterLMS \<= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer (CVSS 6.4, LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes)
- [CVE-2026-120555](https://cve.now/CVE-2026-120555.md): Jupiter X Core \<= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter (CVSS 5.3, artbees Jupiter X Core)
- [CVE-2026-119616](https://cve.now/CVE-2026-119616.md): Noptin \<= 4.4.3 - Unauthenticated Local File Inclusion via 'the\_template\_path' Merge-Tag Attribute via Stored Subscriber first\_name (CVSS 5.9, picocodes Noptin – Newsletter, New Post Notifications & Ema…)
- [CVE-2026-121519](https://cve.now/CVE-2026-121519.md): Social Slider Feed \<= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter (CVSS 6.4, themeisle Social Slider Feed – Social Media Feed & Gallery…)
- [CVE-2026-120737](https://cve.now/CVE-2026-120737.md): Jupiter X Core \<= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive\_query' Parameter (CVSS 5.9, artbees Jupiter X Core)
- [CVE-2026-120082](https://cve.now/CVE-2026-120082.md): GeoDirectory \<= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '\[gd\_dynamic\_content\]' Shortcode in post\_content (CVSS 7.2, paoltaia GeoDirectory – WP Business Directory Plugin and Cl…)
- [CVE-2026-120520](https://cve.now/CVE-2026-120520.md): Greenshift \<= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter (CVSS 5.3, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2026-119219](https://cve.now/CVE-2026-119219.md): Jupiter X Core \<= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta (CVSS 5.4, artbees Jupiter X Core)
- [CVE-2026-118046](https://cve.now/CVE-2026-118046.md): JS Help Desk \<= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket\_message' Ticket Field via VenoBox… (CVSS 6.4, rabilal JS Help Desk – AI-Powered Support & Ticketing System)
- [CVE-2026-119070](https://cve.now/CVE-2026-119070.md): Optimole \<= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer (CVSS 7.2, Optimole – Optimize Images | Convert WebP & AVIF | CDN & La…)
- [CVE-2026-118054](https://cve.now/CVE-2026-118054.md): LearnPress \<= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review\_title' Parameter (CVSS 6.4, thimpress LearnPress – Course Review)
- [CVE-2026-116562](https://cve.now/CVE-2026-116562.md): Motors \<= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm\_f\_s' Parameter (CVSS 6.4, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2026-93754](https://cve.now/CVE-2026-93754.md): payever – WooCommerce Gateway \<= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution (CVSS 9.8, payever Checkout – Composable Payment Gateway)
- [CVE-2026-120512](https://cve.now/CVE-2026-120512.md): Form Maker by 10Web \<= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value (CVSS 7.2, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/daily/2026-11-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.