Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
398,751 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-110899 | 7.1 High | WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
| CVE-2026-107435 | 7.1 High | WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability | Oct 21, 2026 |
| CVE-2026-17557 | 6.5 Medium | Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding | Oct 21, 2026 |
| CVE-2026-111074 | 8.7 High | JITServer: Pre-authentication remote Denial of Service via integer overflow infinite loop in MessageBuffer::computeRequiredCapacity() | Oct 21, 2026 |
| CVE-2026-96901 | 3.7 Low | Cart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery Token | Oct 21, 2026 |
| CVE-2026-92999 | 5.3 Medium | Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action | Oct 21, 2026 |
| CVE-2026-92998 | 8.6 High | Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters | Oct 21, 2026 |
| CVE-2026-92997 | 8.6 High | Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter | Oct 21, 2026 |
| CVE-2026-88784 | 7.5 High | Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting | Oct 21, 2026 |
| CVE-2026-87838 | 6.5 Medium | Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook | Oct 21, 2026 |
| CVE-2026-87837 | 5.3 Medium | Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook | Oct 21, 2026 |
| CVE-2026-86611 | 4.3 Medium | Download Manager (Free & Pro) - Privacy Settings Update via CSRF | Oct 21, 2026 |
| CVE-2026-85642 | 7.5 High | Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS | Oct 21, 2026 |
| CVE-2026-81813 | 6.8 Medium | Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass | Oct 21, 2026 |
| CVE-2026-81812 | 6.4 Medium | Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload | Oct 21, 2026 |
| CVE-2026-79627 | 7.1 High | Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass | Oct 21, 2026 |
| CVE-2026-15261 | 5.3 Medium | TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key | Oct 21, 2026 |
| CVE-2026-111957 | 5.3 Medium | SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback | Oct 21, 2026 |
| CVE-2026-111956 | 5.9 Medium | WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure | Oct 21, 2026 |
| CVE-2026-111955 | 6.5 Medium | WholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval Bypass | Oct 21, 2026 |
| CVE-2026-111949 | 7.5 High | miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding | Oct 21, 2026 |
| CVE-2026-111948 | 7.1 High | Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions | Oct 21, 2026 |
| CVE-2026-111947 | 5.5 Medium | Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication | Oct 21, 2026 |
| CVE-2026-111596 | 5.3 Medium | Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR | Oct 21, 2026 |
| CVE-2026-111574 | 7.5 High | Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox | Oct 21, 2026 |
| CVE-2026-110982 | 4.9 Medium | AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt | Oct 21, 2026 |
| CVE-2026-110651 | 6.8 Medium | Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer | Oct 21, 2026 |
| CVE-2026-110523 | 8.1 High | WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect | Oct 21, 2026 |
| CVE-2026-110514 | 4.9 Medium | WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR | Oct 21, 2026 |
| CVE-2026-109926 | 4.3 Medium | Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation | Oct 21, 2026 |
| CVE-2026-109147 | 7.1 High | WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter | Oct 21, 2026 |
| CVE-2026-108073 | 5.3 Medium | SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter | Oct 21, 2026 |
| CVE-2026-107790 | 6.8 Medium | WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title | Oct 21, 2026 |
| CVE-2026-107789 | 5.3 Medium | SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR | Oct 21, 2026 |
| CVE-2026-107788 | 4.3 Medium | SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion | Oct 21, 2026 |
| CVE-2026-107506 | 7.5 High | Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting | Oct 21, 2026 |
| CVE-2026-107237 | 8.2 High | Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live | Oct 21, 2026 |
| CVE-2026-107128 | 5.0 Medium | Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization | Oct 21, 2026 |
| CVE-2026-107127 | 7.5 High | Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF | Oct 21, 2026 |
| CVE-2026-106932 | 6.5 Medium | Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice | Oct 21, 2026 |
| CVE-2026-105999 | 5.3 Medium | Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure | Oct 21, 2026 |
| CVE-2026-105998 | 5.3 Medium | Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization | Oct 21, 2026 |
| CVE-2026-105996 | 4.8 Medium | Booking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable Token | Oct 21, 2026 |
| CVE-2026-105992 | 5.3 Medium | Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass | Oct 21, 2026 |
| CVE-2026-105262 | 8.0 High | Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation | Oct 21, 2026 |
| CVE-2026-105257 | 2.7 Low | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR | Oct 21, 2026 |
| CVE-2026-103302 | 5.3 Medium | Payment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret | Oct 21, 2026 |
| CVE-2026-102499 | 7.7 High | Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action | Oct 21, 2026 |
| CVE-2026-100145 | 6.5 Medium | Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route | Oct 21, 2026 |
| CVE-2026-93856 | 4.3 Medium | In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the… | Oct 21, 2026 |
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.