CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 23:07 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-96818 | WE WP Express Checkout (Accept PayPal Payments) mra13 / Team Tips and Tricks HQ | 7.5 | Sep 30 | WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability |
| CVE-2026-96817 | MF MakeCommerce for WooCommerce MakeCommerce.net | 8.2 | Sep 30 | WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability |
| CVE-2026-96816 | TS Trusted Shops Easy Integration for WooCommerce vendidero | 7.1 | Sep 30 | WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96815 | VI Vitepos appsbd | 7.2 | Sep 30 | WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability |
| CVE-2026-96814 | WP WooCommerce Product Table Lite WP Titan Labs | 7.1 | Sep 30 | WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96352 | YW YITH WooCommerce Ajax Search YITHEMES | 7.1 | Sep 30 | WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96351 | CL Classified Listing RadiusTheme | 7.1 | Sep 30 | WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-96348 | BO Bookly Bookly | 7.5 | Sep 30 | WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability |
| CVE-2026-96346 | WE WP ERP weDevs | 7.6 | Sep 30 | WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability |
| CVE-2026-96345 | ES Estatik Estatik | 7.6 | Sep 30 | WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability |
| CVE-2026-96344 | EP eCommerce Product Catalog impleCode | 7.2 | Sep 30 | WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability |
| CVE-2026-96343 | WE WP ERP weDevs | 7.2 | Sep 30 | WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability |
| CVE-2026-95587 | HM Hostinger Migrator Hostinger | 7.5 | Sep 30 | WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability |
| CVE-2026-95531 | CF Conversational Forms for ChatBot QuantumCloud | 8.8 | Sep 30 | WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability |
| CVE-2026-94683 | DE DesignSetGo Justin Nealey | 8.8 | Sep 30 | WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability |
| CVE-2026-94678 | GL Go Live Update Urls Mat Lipe | 8.8 | Sep 30 | WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability |
| CVE-2026-94677 | KW Kadence WooCommerce Email Designer Nexcess | 7.2 | Sep 30 | WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability |
| CVE-2026-94499 | FO FormGent wpWax | 7.1 | Sep 30 | WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability |
| CVE-2026-94178 | IA Import and export users and customers Javier Carazo | 7.5 | Sep 30 | WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability |
| CVE-2026-94177 | GA GamiPress Ruben Garcia | 8.5 | Sep 30 | WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability |
| CVE-2026-94123 | NG NextGEN Gallery Syed Balkhi | 7.5 | Sep 30 | WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability |
| CVE-2026-94122 | RS Responsive Slider Gallery A WP Life | 7.2 | Sep 30 | WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability |
| CVE-2026-94121 | 1B 10Web Booster – Website speed optimization, Cache & Page Speed optimizer 10Web | 8.8 | Sep 30 | WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability |
| CVE-2026-94120 | GL GravityExport Lite for Gravity Forms GravityKit | 7.5 | Sep 30 | WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability |
| CVE-2026-94115 | EP Easy Pricing Tables Fatcatapps | 8.5 | Sep 30 | WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability |
| CVE-2026-94082 | QC Quiz Cat Fatcatapps | 7.6 | Sep 30 | WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability |
| CVE-2026-94081 | WP WordPress Persistent Login lukeseager | 7.1 | Sep 30 | WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-94078 | SR Site Reviews Gemini Labs | 7.1 | Sep 30 | WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-94076 | SP SEO Plugin by Squirrly SEO SEO Squirrly | 8.8 | Sep 30 | WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability |
| CVE-2026-93771 | CO Cost of Goods for WooCommerce WPFactory | 7.2 | Sep 30 | WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability |
| CVE-2026-93770 | WS WP Statistics VeronaLabs | 7.1 | Sep 30 | WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-93651 | MA Minimum and Maximum Quantity for WooCommerce Dotstore | 7.2 | Sep 30 | WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability |
| CVE-2026-93624 | MP Music Player for WooCommerce codepeople | 7.2 | Sep 30 | WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability |
| CVE-2026-93621 | WD WP Data Access Passionate Programmer Peter | 8.2 | Sep 30 | WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability |
| CVE-2026-93514 | NF Notification for Telegram rainafarai | 7.1 | Sep 30 | WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-93512 | JP JW Player for WordPress ilGhera | 7.1 | Sep 30 | WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-62085 | WA WP Activity Log Melapress | 7.6 | Sep 30 | WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability |
| CVE-2026-27371 | WP WPFunnels WPFunnels | 7.1 | Sep 30 | WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability |
| CVE-2026-95616 | AW Apache WSS4J Apache Software Foundation | 7.5 | Sep 30 | Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions |
| CVE-2026-103321 | MI MISP MISP | 8.3 | Sep 30 | MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image |
| CVE-2026-92121 | AW Apache WSS4J Apache Software Foundation | 7.5 | Sep 30 | Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference |
| CVE-2026-85532 | AW Apache WSS4J Apache Software Foundation | 7.5 | Sep 30 | Apache WSS4J: Insufficient Validation of Derived-Key Parameters |
| CVE-2026-103242 | RH Red Hat Enterprise Linux 10 Red Hat | 7.1 | Sep 30 | Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag |
| CVE-2026-62146 | RH Red Hat OpenShift Container Platform 4.16 Red Hat | 7.8 | Sep 30 | Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket |
| CVE-2026-10739 | SC SDP Client Cato Networks | 8.5 | Sep 30 | Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation |
| CVE-2026-76992 | DS Development System 3 CODESYS | 7.5 | Sep 30 | Uncontrolled Memory Allocation in CODESYS Gateway Client |
| CVE-2026-103239 | MI MISP MISP | 8.6 | Sep 30 | MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection |
| CVE-2026-103237 | MI MISP MISP | 8.3 | Sep 30 | MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows |
| CVE-2026-93994 | AM Apache MINA SSHD Apache Software Foundation | 8.1 | Sep 30 | Apache MINA SSHD: Repeated-publickey policy bypass on server |
| CVE-2026-10764 | BV BVMS IQSIGHT | 8.7 | Sep 30 | Information disclosure in BVMS 4.5 up to 12.3 |