CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 19:37 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-2839 New | AC Advanced Custom Fields: Extended hwk-fr | 5.3 | Oct 28 | Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints |
| CVE-2026-116761 New | CM CMB2 jtsternberg | 5.4 | Oct 28 | CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form |
| CVE-2026-108366 New | EA easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution wpdevteam | 6.4 | Oct 28 | easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute |
| CVE-2026-110071 New | MB Mang Board kitae-park | 6.4 | Oct 28 | Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute |
| CVE-2026-111213 New | TT Travelly – Tour & Travel Booking Manager for WooCommerce magepeopleteam | 4.3 | Oct 28 | Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter |
| CVE-2026-116610 New | CL Clean Login hornero | 4.3 | Oct 28 | Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook |
| CVE-2026-116749 New | VC VikRentCar Car Rental Management System e4jvikwp | 6.4 | Oct 28 | VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute |
| CVE-2026-92098 New | WM Webheadcoder Multi-Step Forms for Contact Form 7 webheadllc | 6.1 | Oct 28 | Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter |
| CVE-2026-109980 New | RP Related Posts for WordPress barrykooij | 4.3 | Oct 28 | Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter |
| CVE-2026-104729 New | AF Avada (Fusion) Builder themefusion | 6.4 | Oct 28 | Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes |
| CVE-2026-118164 New | ID If-So Dynamic Content – Elementor & All Page Builders Personalization ifso | 6.4 | Oct 28 | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter |
| CVE-2026-100175 New | PO Postie wayneallen-1 | 5.4 | Oct 28 | Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink |
| CVE-2026-77188 New | WW Waitlist Woocommerce ( Back in stock notifier ) xootix | 6.4 | Oct 28 | Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute |
| CVE-2026-110020 New | RS Rich Showcase for Google Reviews widgetpack | 6.5 | Oct 28 | Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page |
| CVE-2026-109979 New | RP Related Posts for WordPress barrykooij | 4.3 | Oct 28 | Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter |
| CVE-2026-104740 New | ID If-So Dynamic Content – Elementor & All Page Builders Personalization ifso | 6.4 | Oct 28 | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute |
| CVE-2026-111372 New | AC AI ChatBot for WooCommerce – WoowBot quantumcloud | 4.3 | Oct 28 | AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action |
| CVE-2026-109978 New | CB Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox cozythemes | 6.4 | Oct 28 | Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute |
| CVE-2026-76058 New | PB PayPal Brasil para WooCommerce odefranca | 5.3 | Oct 28 | PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action |
| CVE-2026-109972 New | SE s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions clavaque | 6.4 | Oct 28 | s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute |
| CVE-2026-111068 New | DE DesignSetGo justinnealey | 4.4 | Oct 28 | DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute |
| CVE-2026-109590 New | TT Travelly – Tour & Travel Booking Manager for WooCommerce magepeopleteam | 6.4 | Oct 28 | Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes |
| CVE-2026-109385 New | UC UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks posimyththemes | 6.4 | Oct 28 | UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL |
| CVE-2026-103996 New | ID If-So Dynamic Content – Elementor & All Page Builders Personalization ifso | 6.4 | Oct 28 | If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute |
| CVE-2026-103370 New | AS Awesome Support – WordPress HelpDesk & Support Plugin awesomesupport | 6.4 | Oct 28 | Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion |
| CVE-2026-116609 New | WV WP Visitor Statistics (Real Time Traffic) osamaesh | 6.5 | Oct 28 | WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute |
| CVE-2026-115281 New | RC Recipe Card Blocks Lite | 6.8 | Oct 28 | Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute |
| CVE-2026-115255 New | WR WP Roster | 5.3 | Oct 28 | WP Roster < 2.35 - Unauthenticated Roster Member Deletion |
| CVE-2026-115225 New | CE Customer Engagement System | 5.8 | Oct 28 | Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup |
| CVE-2026-115224 New | CE Customer Engagement System | 4.1 | Oct 28 | Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding |
| CVE-2026-113813 New | PF PayPlug for WooCommerce (Official) | 6.5 | Oct 28 | PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure |
| CVE-2026-113488 New | GE GeoDirectory | 6.8 | Oct 28 | GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute |
| CVE-2026-113487 New | GE GeoDirectory | 6.8 | Oct 28 | GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute |
| CVE-2026-113486 New | ML Media Library Assistant | 6.5 | Oct 28 | Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF |
| CVE-2026-113485 New | ML Media Library Assistant | 6.5 | Oct 28 | Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF |
| CVE-2026-111967 New | MA MP3 Audio Player | 6.8 | Oct 28 | MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute |
| CVE-2026-111960 New | RM Royal MCP | 4.3 | Oct 28 | Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability |
| CVE-2026-111031 New | WE Welcart e-Commerce | 4.7 | Oct 28 | Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter |
| CVE-2026-111027 New | WE Welcart e-Commerce | 6.8 | Oct 28 | Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter |
| CVE-2026-110691 New | WP WPOrLogin | 6.5 | Oct 28 | WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update |
| CVE-2026-110524 New | CA Copy Anything to Clipboard for WordPress | 6.8 | Oct 28 | Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute |
| CVE-2026-110509 New | EA Essential Addons for Elementor | 5.3 | Oct 28 | Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler |
| CVE-2026-110506 New | PB Page Builder by SiteOrigin | 6.8 | Oct 28 | Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class |
| CVE-2026-110292 New | PF PayPlug for WooCommerce (Official) | 6.5 | Oct 28 | PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent |
| CVE-2026-107100 New | RA Royal Addons for Elementor | 5.3 | Oct 28 | Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content |
| CVE-2026-107098 New | RA Royal Addons for Elementor | 6.8 | Oct 28 | Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting |
| CVE-2026-107097 New | RA Royal Addons for Elementor | 5.3 | Oct 28 | Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe |
| CVE-2026-106003 New | CR Court Reservation | 5.3 | Oct 28 | Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion |
| CVE-2026-106002 New | CR Court Reservation | 5.3 | Oct 28 | Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion |
| CVE-2026-105997 New | BP Booking Package | 5.3 | Oct 28 | Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient |