Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,131 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-96900 | 5.3 Medium | Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR | Oct 14, 2026 |
| CVE-2026-94360 | 5.3 Medium | Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks | Oct 14, 2026 |
| CVE-2026-94261 | 5.3 Medium | Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id | Oct 14, 2026 |
| CVE-2026-94260 | 5.3 Medium | Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure | Oct 14, 2026 |
| CVE-2026-94254 | 5.3 Medium | SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter | Oct 14, 2026 |
| CVE-2026-92426 | 4.9 Medium | YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion | Oct 14, 2026 |
| CVE-2026-92409 | 6.8 Medium | Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode | Oct 14, 2026 |
| CVE-2026-91076 | 5.3 Medium | Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed | Oct 14, 2026 |
| CVE-2026-90989 | 4.3 Medium | Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints | Oct 14, 2026 |
| CVE-2026-89288 | 8.6 High | Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter | Oct 14, 2026 |
| CVE-2026-88927 | 4.3 Medium | rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR | Oct 14, 2026 |
| CVE-2026-87974 | 5.3 Medium | Asaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via Webhook | Oct 14, 2026 |
| CVE-2026-87968 | 5.3 Medium | Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration | Oct 14, 2026 |
| CVE-2026-87843 | 6.5 Medium | Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page | Oct 14, 2026 |
| CVE-2026-86799 | 8.8 High | Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission | Oct 14, 2026 |
| CVE-2026-86797 | 6.8 Medium | Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link | Oct 14, 2026 |
| CVE-2026-86787 | 7.2 High | Affiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php Directive | Oct 14, 2026 |
| CVE-2026-85345 | 4.1 Medium | FV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_data | Oct 14, 2026 |
| CVE-2026-85000 | 5.3 Medium | EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating | Oct 14, 2026 |
| CVE-2026-108069 | 5.3 Medium | Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment() | Oct 14, 2026 |
| CVE-2026-108066 | 2.7 Low | WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR | Oct 14, 2026 |
| CVE-2026-108064 | 6.5 Medium | WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler | Oct 14, 2026 |
| CVE-2026-107594 | 10.0 Critical | File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion | Oct 14, 2026 |
| CVE-2026-107508 | 8.6 High | Ultimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' Parameter | Oct 14, 2026 |
| CVE-2026-107320 | 5.3 Medium | GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure | Oct 14, 2026 |
| CVE-2026-107319 | 4.3 Medium | GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure | Oct 14, 2026 |
| CVE-2026-107178 | 6.8 Medium | Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter | Oct 14, 2026 |
| CVE-2026-107160 | 5.3 Medium | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error Message | Oct 14, 2026 |
| CVE-2026-107158 | 5.3 Medium | LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route | Oct 14, 2026 |
| CVE-2026-107126 | 8.8 High | WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header | Oct 14, 2026 |
| CVE-2026-106646 | 5.9 Medium | Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers | Oct 14, 2026 |
| CVE-2026-106469 | 6.8 Medium | Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon | Oct 14, 2026 |
| CVE-2026-106166 | 5.3 Medium | NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter | Oct 14, 2026 |
| CVE-2026-106099 | 5.3 Medium | WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export | Oct 14, 2026 |
| CVE-2026-106098 | 5.3 Medium | WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update | Oct 14, 2026 |
| CVE-2026-105975 | 5.3 Medium | CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference | Oct 14, 2026 |
| CVE-2026-105969 | 5.3 Medium | CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure | Oct 14, 2026 |
| CVE-2026-105261 | 6.8 Medium | PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes | Oct 14, 2026 |
| CVE-2026-104751 | 5.3 Medium | Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion | Oct 14, 2026 |
| CVE-2026-104644 | 6.8 Medium | Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update | Oct 14, 2026 |
| CVE-2026-103307 | 8.6 High | Walletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook | Oct 14, 2026 |
| CVE-2026-94370 | 6.5 Medium | Memory corruption (double free / use-after-free) vulnerability in core string handling impacts Qt for MCUs | Oct 14, 2026 |
| CVE-2026-110459 | 8.6 High | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device. | Oct 14, 2026 |
| CVE-2026-110458 | 3.7 Low | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device. | Oct 14, 2026 |
| CVE-2026-107153 | 7.0 High | Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device, a crafted system image may be installed. | Oct 14, 2026 |
| CVE-2026-110457 | 3.7 Low | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device. | Oct 14, 2026 |
| CVE-2026-110456 | 5.3 Medium | A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device. | Oct 14, 2026 |
| CVE-2026-110455 | 8.1 High | A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device. | Oct 14, 2026 |
| CVE-2026-110454 | 5.3 Medium | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device. | Oct 14, 2026 |
| CVE-2026-106931 | 8.5 High | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product. | Oct 14, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.