CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 07:13 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-113494 New | GE GeoDirectory | 2.7 | Oct 28 | GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode |
| CVE-2026-113488 New | GE GeoDirectory | 6.8 | Oct 28 | GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute |
| CVE-2026-113487 New | GE GeoDirectory | 6.8 | Oct 28 | GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute |
| CVE-2026-113486 New | ML Media Library Assistant | 6.5 | Oct 28 | Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF |
| CVE-2026-113485 New | ML Media Library Assistant | 6.5 | Oct 28 | Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF |
| CVE-2026-111967 New | MA MP3 Audio Player | 6.8 | Oct 28 | MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute |
| CVE-2026-111961 New | RM Royal MCP | 3.8 | Oct 28 | Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page |
| CVE-2026-111960 New | RM Royal MCP | 4.3 | Oct 28 | Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability |
| CVE-2026-111577 New | GO GoSMTP | 7.2 | Oct 28 | GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings |
| CVE-2026-111032 New | WE Welcart e-Commerce | 3.8 | Oct 28 | Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax |
| CVE-2026-111031 New | WE Welcart e-Commerce | 4.7 | Oct 28 | Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter |
| CVE-2026-111027 New | WE Welcart e-Commerce | 6.8 | Oct 28 | Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter |
| CVE-2026-111021 New | اپ افزونه پیامک ووکامرس | Persian WooCommerce SMS | 7.1 | Oct 28 | Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter |
| CVE-2026-110691 New | WP WPOrLogin | 6.5 | Oct 28 | WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update |
| CVE-2026-110524 New | CA Copy Anything to Clipboard for WordPress | 6.8 | Oct 28 | Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute |
| CVE-2026-110509 New | EA Essential Addons for Elementor | 5.3 | Oct 28 | Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler |
| CVE-2026-110507 New | PB Page Builder by SiteOrigin | 2.7 | Oct 28 | Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments |
| CVE-2026-110506 New | PB Page Builder by SiteOrigin | 6.8 | Oct 28 | Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class |
| CVE-2026-110292 New | PF PayPlug for WooCommerce (Official) | 6.5 | Oct 28 | PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent |
| CVE-2026-107100 New | RA Royal Addons for Elementor | 5.3 | Oct 28 | Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content |
| CVE-2026-107098 New | RA Royal Addons for Elementor | 6.8 | Oct 28 | Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting |
| CVE-2026-107097 New | RA Royal Addons for Elementor | 5.3 | Oct 28 | Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe |
| CVE-2026-106647 New | RA Royal Addons for Elementor | 3.8 | Oct 28 | Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision |
| CVE-2026-106003 New | CR Court Reservation | 5.3 | Oct 28 | Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion |
| CVE-2026-106002 New | CR Court Reservation | 5.3 | Oct 28 | Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion |
| CVE-2026-105997 New | BP Booking Package | 5.3 | Oct 28 | Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient |
| CVE-2026-105972 New | MC Menu Cart for WooCommerce | 7.5 | Oct 28 | WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute |
| CVE-2026-104694 New | TA Thrive Automator | 6.8 | Oct 28 | Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter |
| CVE-2026-103688 New | CF Checkout Files Upload for WooCommerce | 9.8 | Oct 28 | Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload |
| CVE-2026-103382 New | CF Casso Flow | 5.3 | Oct 28 | Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation |
| CVE-2026-103372 New | PA Payconiq | 5.3 | Oct 28 | Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure |
| CVE-2026-103331 New | UP UniPAY Payment Gateway For WooCommerce | 5.3 | Oct 28 | UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret |
| CVE-2026-15323 New | PD Product Designer for WooCommerce WordPress | Lumise King-Theme | 7.5 | Oct 28 | Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload |
| CVE-2026-109236 New | CE Customer Email Verification for WooCommerce zorem | 4.8 | Oct 28 | Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter |
| CVE-2026-115522 New | AD Agent Development Kit (ADK) for Python Google | 5.3 | Oct 28 | Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python |
| CVE-2026-104384 New | AQ Aquila EagleCloud | 8.7 | Oct 28 | Insufficiently protected credentials in EagleCloud Aquila on-premises version |
| CVE-2026-104383 New | AQ Aquila EagleCloud | 9.4 | Oct 28 | Code injection in EagleCloud Aquila on-premises version |
| CVE-2026-99100 New | LI Linux Linux | – | Oct 28 | wifi: p54: validate firmware record lengths |
| CVE-2026-118276 New | A2 a2ui a2ui-project | 3.5 | Oct 28 | a2ui-project a2ui Parser expression_parser.ts formatString resource consumption |
| CVE-2026-111727 New | AB Appointment Booking Calendar codepeople | 6.4 | Oct 28 | Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter |
| CVE-2026-1928 New | RM Rank Math SEO – AI SEO Tools to Dominate SEO Rankings rankmath | 8.8 | Oct 28 | Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution |
| CVE-2026-116613 New | AT Animated Text Block – Add Typing and Looping Text Effects bplugins | 7.5 | Oct 28 | Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute |
| CVE-2026-111255 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.5 | Oct 28 | affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter |
| CVE-2026-118275 New | A2 a2ui a2ui-project | 5.3 | Oct 28 | a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption |
| CVE-2026-118384 New | MT mtools GNU | 6.1 | Oct 28 | GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c |
| CVE-2026-118274 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui Binder generic-binder.ts resource consumption |
| CVE-2026-118273 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui data-model.ts DataModel.set resource consumption |
| CVE-2026-107745 New | AE AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini tigroumeow | 4.2 | Oct 28 | AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter |
| CVE-2026-109209 New | AV All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugins360 | 6.4 | Oct 28 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC |
| CVE-2026-111314 New | AM affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display cservit | 7.2 | Oct 28 | affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter |