Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,321 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-109218 | 9.8 Critical | Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass | Oct 28, 2026 |
| CVE-2026-109370 | 6.4 Medium | Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute | Oct 28, 2026 |
| CVE-2026-77871 | 6.4 Medium | Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | Oct 28, 2026 |
| CVE-2026-107710 | 6.4 Medium | Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title | Oct 28, 2026 |
| CVE-2026-109988 | 4.4 Medium | Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter | Oct 28, 2026 |
| CVE-2026-2839 | 5.3 Medium | Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints | Oct 28, 2026 |
| CVE-2026-116761 | 5.4 Medium | CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form | Oct 28, 2026 |
| CVE-2026-108366 | 6.4 Medium | easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute | Oct 28, 2026 |
| CVE-2026-110071 | 6.4 Medium | Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-111111 | 7.2 High | Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape | Oct 28, 2026 |
| CVE-2026-111213 | 4.3 Medium | Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter | Oct 28, 2026 |
| CVE-2026-116610 | 4.3 Medium | Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook | Oct 28, 2026 |
| CVE-2026-116749 | 6.4 Medium | VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute | Oct 28, 2026 |
| CVE-2026-92098 | 6.1 Medium | Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter | Oct 28, 2026 |
| CVE-2026-109980 | 4.3 Medium | Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter | Oct 28, 2026 |
| CVE-2026-104729 | 6.4 Medium | Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes | Oct 28, 2026 |
| CVE-2026-118164 | 6.4 Medium | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter | Oct 28, 2026 |
| CVE-2026-100175 | 5.4 Medium | Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink | Oct 28, 2026 |
| CVE-2026-109384 | 8.8 High | The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload | Oct 28, 2026 |
| CVE-2026-77188 | 6.4 Medium | Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-110020 | 6.5 Medium | Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page | Oct 28, 2026 |
| CVE-2026-109979 | 4.3 Medium | Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter | Oct 28, 2026 |
| CVE-2026-111120 | 8.8 High | VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task | Oct 28, 2026 |
| CVE-2026-104740 | 6.4 Medium | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-111372 | 4.3 Medium | AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action | Oct 28, 2026 |
| CVE-2026-109978 | 6.4 Medium | Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute | Oct 28, 2026 |
| CVE-2026-76058 | 5.3 Medium | PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action | Oct 28, 2026 |
| CVE-2026-109972 | 6.4 Medium | s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-111068 | 4.4 Medium | DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute | Oct 28, 2026 |
| CVE-2026-109590 | 6.4 Medium | Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes | Oct 28, 2026 |
| CVE-2026-109385 | 6.4 Medium | UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL | Oct 28, 2026 |
| CVE-2026-103996 | 6.4 Medium | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute | Oct 28, 2026 |
| CVE-2026-110662 | 7.2 High | MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating | Oct 28, 2026 |
| CVE-2026-109381 | 7.2 High | Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter | Oct 28, 2026 |
| CVE-2026-103370 | 6.4 Medium | Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion | Oct 28, 2026 |
| CVE-2026-116609 | 6.5 Medium | WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-115281 | 6.8 Medium | Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute | Oct 28, 2026 |
| CVE-2026-115255 | 5.3 Medium | WP Roster < 2.35 - Unauthenticated Roster Member Deletion | Oct 28, 2026 |
| CVE-2026-115225 | 5.8 Medium | Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup | Oct 28, 2026 |
| CVE-2026-115224 | 4.1 Medium | Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding | Oct 28, 2026 |
| CVE-2026-113813 | 6.5 Medium | PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure | Oct 28, 2026 |
| CVE-2026-113494 | 2.7 Low | GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode | Oct 28, 2026 |
| CVE-2026-113488 | 6.8 Medium | GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute | Oct 28, 2026 |
| CVE-2026-113487 | 6.8 Medium | GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute | Oct 28, 2026 |
| CVE-2026-113486 | 6.5 Medium | Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF | Oct 28, 2026 |
| CVE-2026-113485 | 6.5 Medium | Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF | Oct 28, 2026 |
| CVE-2026-111967 | 6.8 Medium | MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-111961 | 3.8 Low | Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page | Oct 28, 2026 |
| CVE-2026-111960 | 4.3 Medium | Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability | Oct 28, 2026 |
| CVE-2026-111577 | 7.2 High | GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings | Oct 28, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.