CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 30, 17:07 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-62077 | AV Avala BoldThemes | 9.8 | Oct 10 | WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability |
| CVE-2026-62076 | KA Kalles The4 | 9.8 | Oct 10 | WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability |
| CVE-2026-62054 | YR Yacht Rental ThemeREX | 9.8 | Oct 10 | WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability |
| CVE-2026-62053 | WH Wine House ThemeREX | 9.8 | Oct 10 | WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability |
| CVE-2026-62052 | TI Tipsy ThemeREX | 9.8 | Oct 10 | WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability |
| CVE-2026-62051 | ST Stargaze ThemeREX | 9.8 | Oct 10 | WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability |
| CVE-2026-62050 | SP Splendour ThemeREX | 9.8 | Oct 10 | WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability |
| CVE-2026-62032 | DI DirectoryPress Designinvento | 9.8 | Oct 10 | WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability |
| CVE-2026-62031 | UL uListing Stylemix | 9.3 | Oct 10 | WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability |
| CVE-2026-62025 | TT Tailored Tools Tailored Media | 9.0 | Oct 10 | WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability |
| CVE-2026-62024 | CH CodeBard Help Desk CodeBard | 9.9 | Oct 10 | WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability |
| CVE-2026-62022 | TM Tonda Membership Select-Themes | 9.8 | Oct 10 | WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability |
| CVE-2026-42723 | CL CleanSkin AncoraThemes | 9.8 | Oct 10 | WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability |
| CVE-2026-42719 | DU Dynamic User Directory Sarah Giles | 9.8 | Oct 10 | WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability |
| CVE-2026-42718 | BF Booster for WooCommerce Pluggabl | 9.8 | Oct 10 | WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability |
| CVE-2026-42716 | PW Payever - WooCommerce Gateway payever | 9.8 | Oct 10 | WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability |
| CVE-2026-42696 | SB SiteVault – Backup, Restore, Migration & Cloning Royal Plugins | 10.0 | Oct 10 | WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability |
| CVE-2026-40800 | EW ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes ELEXtensions | 9.3 | Oct 10 | WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability |
| CVE-2026-39801 | AI AIWU Sergey | 9.8 | Oct 10 | WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability |
| CVE-2026-108598 | FL floci floci-io | 9.8 | Oct 10 | Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates |
| CVE-2026-106610 | MO miniorange otp verification miniOrange | 9.8 | Oct 10 | WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability |
| CVE-2026-105892 | RF rtMedia for WordPress, BuddyPress and bbPress rtCamp Inc. | 9.8 | Oct 10 | WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability |
| CVE-2026-104398 | AA AFFI – Affiliate Marketing for WooCommerce VillaTheme | 9.8 | Oct 10 | WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability |
| CVE-2026-105889 | TI Tickera Tickera | 9.3 | Oct 10 | WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability |
| CVE-2026-108551 | OP openapi-typescript-codegen ferdikoomen | 9.8 | Oct 10 | openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates |
| CVE-2026-107373 | Product not mapped yet | 9.1 | Oct 10 | ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument |
| CVE-2026-103635 | AD Apache DataSketches Apache Software Foundation | 9.1 | Oct 10 | Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch |
| CVE-2026-103513 | AD Apache DataSketches Apache Software Foundation | 9.8 | Oct 10 | Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch |
| CVE-2026-103501 | AD Apache DataSketches Apache Software Foundation | 9.8 | Oct 10 | Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch |
| CVE-2026-104803 | WM WPCOM Member whyun | 9.8 | Oct 10 | WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback |
| CVE-2026-62045 | BO Booklovers ThemeREX Group | 9.8 | Oct 10 | WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability |
| CVE-2026-62046 | GU Gutentype ThemeREX Group | 9.8 | Oct 10 | WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability |
| CVE-2026-93945 | BA Balance Axiomthemes | 9.8 | Oct 10 | WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability |
| CVE-2026-93944 | CA Camelia ThemeREX Group | 9.8 | Oct 10 | WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability |
| CVE-2026-93943 | CO Convex ThemeREX Group | 9.8 | Oct 10 | WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability |
| CVE-2026-93942 | DW Dwell ThemeREX Group | 9.8 | Oct 10 | WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability |
| CVE-2026-93941 | ED Edema ThemeREX Group | 9.8 | Oct 10 | WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability |
| CVE-2026-93940 | GR Greeny ThemeREX Group | 9.8 | Oct 10 | WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability |
| CVE-2026-93938 | HO Hogwords ThemeREX Group | 9.8 | Oct 10 | WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability |
| CVE-2026-93937 | HY Hygia ThemeREX Group | 9.8 | Oct 10 | WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability |
| CVE-2026-93936 | IP IPharm ThemeREX Group | 9.8 | Oct 10 | WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability |
| CVE-2026-93935 | LP Let's Play ThemeREX Group | 9.8 | Oct 10 | WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability |
| CVE-2026-93934 | PA Partiso ThemeREX Group | 9.8 | Oct 10 | WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability |
| CVE-2026-93933 | RO Rosalinda ThemeREX Group | 9.8 | Oct 10 | WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability |
| CVE-2026-93932 | SC Smart Casa ThemeREX Group | 9.8 | Oct 10 | WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability |
| CVE-2026-93931 | SM Smash ThemeREX Group | 9.8 | Oct 10 | WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability |
| CVE-2026-93930 | TA Tantra ThemeREX Group | 9.8 | Oct 10 | WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability |
| CVE-2026-93929 | TR Travesia ThemeREX Group | 9.8 | Oct 10 | WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability |
| CVE-2026-93927 | VE Veto Axiomthemes | 9.8 | Oct 10 | WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability |
| CVE-2026-104801 | PP PPOM – Product Addons & Custom Fields for WooCommerce themeisle | 9.1 | Oct 10 | PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter |