Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-111472 | 9.3 Critical | SQL injection in TSG Profleet | Oct 16, 2026 |
| CVE-2026-104003 | 5.4 Medium | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Comment Content Rendered on ProfilePress User Profile 'Comments' Tab | Oct 16, 2026 |
| CVE-2026-92766 | 7.5 High | Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter | Oct 16, 2026 |
| CVE-2026-104726 | 6.4 Medium | Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute | Oct 16, 2026 |
| CVE-2026-109224 | 7.2 High | SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment | Oct 16, 2026 |
| CVE-2026-93681 | 6.4 Medium | Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter | Oct 16, 2026 |
| CVE-2026-111311 | 8.8 High | DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint | Oct 16, 2026 |
| CVE-2026-14177 | 7.5 High | User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure | Oct 16, 2026 |
| CVE-2026-96870 | 6.4 Medium | SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter | Oct 16, 2026 |
| CVE-2026-100108 | 6.4 Medium | Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting | Oct 16, 2026 |
| CVE-2026-100106 | 6.4 Medium | FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter | Oct 16, 2026 |
| CVE-2026-75903 | 8.1 High | Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials | Oct 16, 2026 |
| CVE-2026-87111 | 7.2 High | User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header | Oct 16, 2026 |
| CVE-2026-18799 | 4.3 Medium | Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users | Oct 16, 2026 |
| CVE-2026-16251 | 6.5 Medium | Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering | Oct 16, 2026 |
| CVE-2026-18256 | 4.3 Medium | Private team metadata disclosure via the team search API | Oct 16, 2026 |
| CVE-2026-18223 | 5.0 Medium | Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access | Oct 16, 2026 |
| CVE-2026-19076 | 4.4 Medium | Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token | Oct 16, 2026 |
| CVE-2026-18560 | 4.3 Medium | Improper order of authorisations in Mattermost GetFile API leads to an authenticated user to determine a post’s quarantined status | Oct 16, 2026 |
| CVE-2026-16453 | 7.1 High | Mattermost SAML RelayState forgery allows unauthorized team membership | Oct 16, 2026 |
| CVE-2026-19600 | 4.5 Medium | Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts | Oct 16, 2026 |
| CVE-2026-19621 | 6.5 Medium | Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads | Oct 16, 2026 |
| CVE-2026-19603 | 4.3 Medium | Private channel ID disclosure via user status endpoints | Oct 16, 2026 |
| CVE-2026-18795 | 6.4 Medium | Missing server side validation allowed user to quarantine a DM and GM post | Oct 16, 2026 |
| CVE-2026-94169 | 10.0 Critical | WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability | Oct 16, 2026 |
| CVE-2026-94388 | 9.3 Critical | WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability | Oct 16, 2026 |
| CVE-2026-97296 | 8.1 High | WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability | Oct 16, 2026 |
| CVE-2026-96339 | 7.1 High | WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability | Oct 16, 2026 |
| CVE-2026-19867 | 4.3 Medium | Uncapped mention keys in user notification properties allow CPU exhaustion during post processing | Oct 16, 2026 |
| CVE-2026-19601 | 4.9 Medium | Disclosure of AD/LDAP bind password via Test Connection | Oct 16, 2026 |
| CVE-2026-18551 | 6.5 Medium | Mattermost guest account privilege escalation via member roles API | Oct 16, 2026 |
| CVE-2026-19541 | 6.5 Medium | Outgoing OAuth connection client secret exposure during connection validation | Oct 16, 2026 |
| CVE-2026-110366 | 5.3 Medium | WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability | Oct 16, 2026 |
| CVE-2026-104715 | 7.8 High | Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass | Oct 16, 2026 |
| CVE-2026-92115 | 8.8 High | WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action | Oct 16, 2026 |
| CVE-2026-15222 | 5.4 Medium | User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name | Oct 16, 2026 |
| CVE-2026-109401 | 2.7 Low | WP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email | Oct 16, 2026 |
| CVE-2026-97640 | 7.2 High | WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) | Oct 16, 2026 |
| CVE-2026-110252 | 5.4 Medium | WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import | Oct 16, 2026 |
| CVE-2026-109193 | 7.2 High | HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value | Oct 16, 2026 |
| CVE-2026-104730 | 9.8 Critical | Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter | Oct 16, 2026 |
| CVE-2026-19798 | 4.3 Medium | WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints | Oct 16, 2026 |
| CVE-2026-109382 | 6.5 Medium | WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool | Oct 16, 2026 |
| CVE-2026-104755 | 4.8 Medium | WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint | Oct 16, 2026 |
| CVE-2026-107768 | 7.2 High | TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers | Oct 16, 2026 |
| CVE-2026-109388 | 6.4 Medium | HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode | Oct 16, 2026 |
| CVE-2026-110290 | 6.4 Medium | WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute | Oct 16, 2026 |
| CVE-2026-92553 | 8.8 High | YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension | Oct 16, 2026 |
| CVE-2026-111069 | 6.4 Medium | GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field | Oct 16, 2026 |
| CVE-2026-107770 | 6.8 Medium | Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action | Oct 16, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.