Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,123 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-103481 | 6.1 Medium | Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter | Oct 16, 2026 |
| CVE-2026-110019 | 4.3 Medium | Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow | Oct 16, 2026 |
| CVE-2026-110590 | 7.5 High | Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint | Oct 16, 2026 |
| CVE-2026-107746 | 7.5 High | FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter | Oct 16, 2026 |
| CVE-2026-111114 | 7.5 High | Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter | Oct 16, 2026 |
| CVE-2026-109998 | 7.2 High | Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX | Oct 16, 2026 |
| CVE-2026-103911 | 6.5 Medium | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block | Oct 16, 2026 |
| CVE-2026-109191 | 4.3 Medium | Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML | Oct 16, 2026 |
| CVE-2026-109515 | 9.8 Critical | MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter | Oct 16, 2026 |
| CVE-2026-109400 | 7.5 High | InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting | Oct 16, 2026 |
| CVE-2026-110721 | 5.3 Medium | NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route | Oct 16, 2026 |
| CVE-2026-103525 | 7.5 High | FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters | Oct 16, 2026 |
| CVE-2026-111106 | 6.5 Medium | Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter | Oct 16, 2026 |
| CVE-2026-109512 | 6.4 Medium | Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter | Oct 16, 2026 |
| CVE-2026-103895 | 8.1 High | miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State | Oct 16, 2026 |
| CVE-2026-101335 | 6.5 Medium | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags | Oct 16, 2026 |
| CVE-2026-109219 | 9.8 Critical | Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter | Oct 16, 2026 |
| CVE-2026-96562 | 6.5 Medium | Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback | Oct 16, 2026 |
| CVE-2026-111451 | 7.8 High | Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during… | Oct 16, 2026 |
| CVE-2026-111450 | 5.9 Medium | Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server… | Oct 16, 2026 |
| CVE-2026-111449 | 5.9 Medium | Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrator request changes error/debug-display settings in shared application scope. If it overlaps with an… | Oct 16, 2026 |
| CVE-2026-111448 | 3.7 Low | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept… | Oct 16, 2026 |
| CVE-2026-111447 | 8.1 High | Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to submit a nested form for their own parent can update and reassign another… | Oct 16, 2026 |
| CVE-2026-89280 | 4.3 Medium | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id} | Oct 16, 2026 |
| CVE-2026-107758 | 7.2 High | Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments | Oct 16, 2026 |
| CVE-2026-109207 | 7.2 High | RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL | Oct 16, 2026 |
| CVE-2026-104769 | 5.9 Medium | Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link> | Oct 16, 2026 |
| CVE-2026-104745 | 8.1 High | Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter | Oct 16, 2026 |
| CVE-2026-97339 | 7.2 High | Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter | Oct 16, 2026 |
| CVE-2026-93953 | 8.0 High | Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation | Oct 16, 2026 |
| CVE-2026-109990 | 7.2 High | Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content | Oct 16, 2026 |
| CVE-2026-103518 | 4.9 Medium | FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys | Oct 16, 2026 |
| CVE-2026-77829 | 6.4 Medium | Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content | Oct 16, 2026 |
| CVE-2026-93535 | 6.4 Medium | WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute | Oct 16, 2026 |
| CVE-2026-111446 | 8.6 High | Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2… | Oct 16, 2026 |
| CVE-2026-111445 | 8.1 High | Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key… | Oct 16, 2026 |
| CVE-2026-111444 | 9.8 Critical | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and… | Oct 16, 2026 |
| CVE-2026-111443 | 6.5 Medium | Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-Test-Context header or WHEELS_TEST_CONTEXT cookie with any value, or… | Oct 16, 2026 |
| CVE-2026-111442 | 5.3 Medium | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By… | Oct 16, 2026 |
| CVE-2026-109813 | 8.6 High | Shared Hard-coded Root CA Private Key | Oct 16, 2026 |
| CVE-2026-109812 | 6.9 Medium | Missing Authorization on Secret Endpoints | Oct 16, 2026 |
| CVE-2026-100159 | 4.8 Medium | Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers | Oct 16, 2026 |
| CVE-2026-105228 | 7.0 High | ISPSoft Out-of-Bounds Read Vulnerability | Oct 16, 2026 |
| CVE-2026-105227 | 7.0 High | ISPSoft Out-of-Bounds Read Vulnerability | Oct 16, 2026 |
| CVE-2026-111389 | 8.3 High | Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation | Oct 16, 2026 |
| CVE-2026-111388 | 5.3 Medium | Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication | Oct 16, 2026 |
| CVE-2026-111387 | 7.1 High | Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint | Oct 16, 2026 |
| CVE-2026-111386 | 5.3 Medium | Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig | Oct 16, 2026 |
| CVE-2026-111385 | 6.3 Medium | Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools | Oct 16, 2026 |
| CVE-2026-111384 | 7.1 High | Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket | Oct 16, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.