Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,321 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-111032 | 3.8 Low | Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax | Oct 28, 2026 |
| CVE-2026-111031 | 4.7 Medium | Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter | Oct 28, 2026 |
| CVE-2026-111027 | 6.8 Medium | Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter | Oct 28, 2026 |
| CVE-2026-111021 | 7.1 High | Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter | Oct 28, 2026 |
| CVE-2026-110691 | 6.5 Medium | WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update | Oct 28, 2026 |
| CVE-2026-110524 | 6.8 Medium | Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-110509 | 5.3 Medium | Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler | Oct 28, 2026 |
| CVE-2026-110507 | 2.7 Low | Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments | Oct 28, 2026 |
| CVE-2026-110506 | 6.8 Medium | Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class | Oct 28, 2026 |
| CVE-2026-110292 | 6.5 Medium | PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent | Oct 28, 2026 |
| CVE-2026-107100 | 5.3 Medium | Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content | Oct 28, 2026 |
| CVE-2026-107098 | 6.8 Medium | Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting | Oct 28, 2026 |
| CVE-2026-107097 | 5.3 Medium | Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe | Oct 28, 2026 |
| CVE-2026-106647 | 3.8 Low | Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision | Oct 28, 2026 |
| CVE-2026-106003 | 5.3 Medium | Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion | Oct 28, 2026 |
| CVE-2026-106002 | 5.3 Medium | Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion | Oct 28, 2026 |
| CVE-2026-105997 | 5.3 Medium | Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient | Oct 28, 2026 |
| CVE-2026-105972 | 7.5 High | WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute | Oct 28, 2026 |
| CVE-2026-104694 | 6.8 Medium | Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter | Oct 28, 2026 |
| CVE-2026-103688 | 9.8 Critical | Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload | Oct 28, 2026 |
| CVE-2026-103382 | 5.3 Medium | Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation | Oct 28, 2026 |
| CVE-2026-103372 | 5.3 Medium | Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure | Oct 28, 2026 |
| CVE-2026-103331 | 5.3 Medium | UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret | Oct 28, 2026 |
| CVE-2026-15323 | 7.5 High | Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload | Oct 28, 2026 |
| CVE-2026-109236 | 4.8 Medium | Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter | Oct 28, 2026 |
| CVE-2026-115522 | 5.3 Medium | Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python | Oct 28, 2026 |
| CVE-2026-104384 | 8.7 High | Insufficiently protected credentials in EagleCloud Aquila on-premises version | Oct 28, 2026 |
| CVE-2026-104383 | 9.4 Critical | Code injection in EagleCloud Aquila on-premises version | Oct 28, 2026 |
| CVE-2026-99100 | Not scored | wifi: p54: validate firmware record lengths | Oct 28, 2026 |
| CVE-2026-118276 | 5.1 Medium | a2ui-project a2ui Parser expression_parser.ts formatString resource consumption | Oct 28, 2026 |
| CVE-2026-111727 | 6.4 Medium | Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter | Oct 28, 2026 |
| CVE-2026-1928 | 8.8 High | Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution | Oct 28, 2026 |
| CVE-2026-116613 | 7.5 High | Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-111255 | 7.5 High | affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter | Oct 28, 2026 |
| CVE-2026-118275 | 6.9 Medium | a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption | Oct 28, 2026 |
| CVE-2026-118384 | 6.1 Medium | GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c. | Oct 28, 2026 |
| CVE-2026-118274 | 5.3 Medium | a2ui-project a2ui Binder generic-binder.ts resource consumption | Oct 28, 2026 |
| CVE-2026-118273 | 5.3 Medium | a2ui-project a2ui data-model.ts DataModel.set resource consumption | Oct 28, 2026 |
| CVE-2026-107745 | 4.2 Medium | AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter | Oct 28, 2026 |
| CVE-2026-109209 | 6.4 Medium | All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC | Oct 28, 2026 |
| CVE-2026-111314 | 7.2 High | affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter | Oct 28, 2026 |
| CVE-2026-97019 | 7.2 High | AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-109999 | 7.2 High | AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter | Oct 28, 2026 |
| CVE-2026-109974 | 6.4 Medium | All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute | Oct 28, 2026 |
| CVE-2026-84999 | 9.8 Critical | Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler | Oct 28, 2026 |
| CVE-2026-107625 | 6.4 Medium | Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field | Oct 28, 2026 |
| CVE-2026-115624 | 6.9 Medium | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status… | Oct 28, 2026 |
| CVE-2026-109848 | 2.3 Low | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the… | Oct 28, 2026 |
| CVE-2026-105272 | 2.3 Low | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and… | Oct 28, 2026 |
| CVE-2026-118378 | 8.5 High | Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name | Oct 28, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.