CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 14:35 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-2839 New | AC Advanced Custom Fields: Extended hwk-fr | 5.3 | Oct 28 | Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints |
| CVE-2026-116761 New | CM CMB2 jtsternberg | 5.4 | Oct 28 | CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form |
| CVE-2026-108366 New | EA easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution wpdevteam | 6.4 | Oct 28 | easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute |
| CVE-2026-110071 New | MB Mang Board kitae-park | 6.4 | Oct 28 | Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute |
| CVE-2026-111213 New | TT Travelly – Tour & Travel Booking Manager for WooCommerce magepeopleteam | 4.3 | Oct 28 | Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter |
| CVE-2026-116610 New | CL Clean Login hornero | 4.3 | Oct 28 | Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook |
| CVE-2026-116749 New | VC VikRentCar Car Rental Management System e4jvikwp | 6.4 | Oct 28 | VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute |
| CVE-2026-92098 New | WM Webheadcoder Multi-Step Forms for Contact Form 7 webheadllc | 6.1 | Oct 28 | Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter |
| CVE-2026-109980 New | RP Related Posts for WordPress barrykooij | 4.3 | Oct 28 | Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter |
| CVE-2026-104729 New | AF Avada (Fusion) Builder themefusion | 6.4 | Oct 28 | Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes |
| CVE-2026-118164 New | ID If-So Dynamic Content – Elementor & All Page Builders Personalization ifso | 6.4 | Oct 28 | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter |
| CVE-2026-100175 New | PO Postie wayneallen-1 | 5.4 | Oct 28 | Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink |
| CVE-2026-77188 New | WW Waitlist Woocommerce ( Back in stock notifier ) xootix | 6.4 | Oct 28 | Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute |
| CVE-2026-110020 New | RS Rich Showcase for Google Reviews widgetpack | 6.5 | Oct 28 | Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page |
| CVE-2026-109979 New | RP Related Posts for WordPress barrykooij | 4.3 | Oct 28 | Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter |
| CVE-2026-104740 New | ID If-So Dynamic Content – Elementor & All Page Builders Personalization ifso | 6.4 | Oct 28 | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute |
| CVE-2026-111372 New | AC AI ChatBot for WooCommerce – WoowBot quantumcloud | 4.3 | Oct 28 | AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action |
| CVE-2026-109978 New | CB Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox cozythemes | 6.4 | Oct 28 | Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute |
| CVE-2026-76058 New | PB PayPal Brasil para WooCommerce odefranca | 5.3 | Oct 28 | PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action |
| CVE-2026-109972 New | SE s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions clavaque | 6.4 | Oct 28 | s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute |
| CVE-2026-111068 New | DE DesignSetGo justinnealey | 4.4 | Oct 28 | DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute |
| CVE-2026-109590 New | TT Travelly – Tour & Travel Booking Manager for WooCommerce magepeopleteam | 6.4 | Oct 28 | Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes |
| CVE-2026-109385 New | UC UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks posimyththemes | 6.4 | Oct 28 | UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL |
| CVE-2026-103996 New | ID If-So Dynamic Content – Elementor & All Page Builders Personalization ifso | 6.4 | Oct 28 | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute |
| CVE-2026-103370 New | AS Awesome Support – WordPress HelpDesk & Support Plugin awesomesupport | 6.4 | Oct 28 | Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion |
| CVE-2026-116609 New | WV WP Visitor Statistics (Real Time Traffic) osamaesh | 6.5 | Oct 28 | WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute |
| CVE-2026-109236 New | CE Customer Email Verification for WooCommerce zorem | 4.8 | Oct 28 | Customer Email Verification for WooCommerce <= 2.8.2 - Unauthenticated Authentication Bypass via Predictable Email-Verification Token to 'cusomer_email_verify' Parameter |
| CVE-2026-115522 New | AD Agent Development Kit (ADK) for Python Google | 5.3 | Oct 28 | Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python |
| CVE-2026-111727 New | AB Appointment Booking Calendar codepeople | 6.4 | Oct 28 | Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter |
| CVE-2026-118275 New | A2 a2ui a2ui-project | 5.3 | Oct 28 | a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption |
| CVE-2026-118384 New | MT mtools GNU | 6.1 | Oct 28 | GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c |
| CVE-2026-118274 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui Binder generic-binder.ts resource consumption |
| CVE-2026-118273 New | A2 a2ui a2ui-project | 4.3 | Oct 28 | a2ui-project a2ui data-model.ts DataModel.set resource consumption |
| CVE-2026-107745 New | AE AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini tigroumeow | 4.2 | Oct 28 | AI Engine <= 3.8.4 - Authenticated (Subscriber+) Limited Media File Deletion via 'metadata' Parameter |
| CVE-2026-109209 New | AV All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugins360 | 6.4 | Oct 28 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC |
| CVE-2026-109974 New | AV All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugins360 | 6.4 | Oct 28 | All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute |
| CVE-2026-107625 New | UM Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimatemember | 6.4 | Oct 28 | Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field |
| CVE-2026-115624 New | GR GROWI GROWI, Inc. | 5.3 | Oct 28 | GROWI contains a missing authorization check vulnerability in its collaborative editing feature |
| CVE-2026-109848 New | GR GROWI GROWI, Inc. | 4.2 | Oct 28 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key |
| CVE-2026-105272 New | GR GROWI GROWI, Inc. | 4.2 | Oct 28 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key |
| CVE-2026-118376 New | WE WeKnora Tencent | 5.3 | Oct 28 | WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses |
| CVE-2026-118374 New | LI LibreSSL OpenBSD | 5.9 | Oct 28 | LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response |
| CVE-2026-118370 New | LI libexpat libexpat | 5.9 | Oct 28 | libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes |
| CVE-2026-117610 New | LI libexpat libexpat | 5.9 | Oct 28 | libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser |
| CVE-2026-117608 New | AS assimp assimp | 6.1 | Oct 28 | Assimp through 6.0.5 Heap Out-of-Bounds Read via MD2 Importer Integer Overflow |
| CVE-2026-117606 New | NE NexoPOS Blair2004 | 5.4 | Oct 28 | NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions |
| CVE-2026-117605 New | NO nopCommerce nopSolutions | 4.3 | Oct 28 | nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers |
| CVE-2014-125137 New | CE Cart Engine C97net | 6.5 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php |
| CVE-2014-125136 New | CE Cart Engine C97net | 5.9 | Oct 28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup |
| CVE-2013-20009 New | WA WAG200G Linksys | 4.8 | Oct 28 | Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter |