Browse All CVEs
10,522 vulnerabilities matching filters.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-65466 |
medium | 4.9 | 0.0019 | 2026-10-29 | Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions. | |
CVE-2026-65467 |
medium | 4.9 | 0.0019 | 2026-10-29 | Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions. | |
CVE-2026-65468 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions. | |
CVE-2026-65469 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions. | |
CVE-2026-65470 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions. | |
CVE-2026-65472 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions. | |
CVE-2026-65473 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 version | |
CVE-2026-65474 |
medium | 5.3 | 0.0033 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions. | |
CVE-2026-65475 |
medium | 6.5 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-65476 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in Civi <= 2.2.4 versions. | |
CVE-2026-65478 |
medium | 5.4 | 0.0023 | 2026-10-29 | Subscriber Broken Access Control in ListingPro <= 2.9.10 versions. | |
CVE-2026-65479 |
medium | 5.4 | 0.0029 | 2026-10-29 | Subscriber Broken Access Control in Reviewer <= 3.14.2 versions. | |
CVE-2026-65480 |
medium | 6.5 | 0.0022 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-65483 |
medium | 5.9 | 0.0024 | 2026-10-29 | Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions. | |
CVE-2026-65484 |
medium | 6.3 | 0.0026 | 2026-10-29 | Contributor Broken Access Control in Style Kits <= 2.6.5 versions. | |
CVE-2026-65485 |
medium | 5.3 | 0.0031 | 2026-10-29 | Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions. | |
CVE-2026-65486 |
medium | 5.3 | 0.0031 | 2026-10-29 | Unauthenticated Broken Access Control in Event post <= 6.0.1 versions. | |
CVE-2026-65487 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in Photography <= 7.7.6 versions. | |
CVE-2026-65490 |
medium | 5.3 | 0.0033 | 2026-10-29 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability i | |
CVE-2026-65491 |
medium | 4.3 | 0.0027 | 2026-10-29 | Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions. | |
CVE-2026-65496 |
medium | 4.4 | 0.0021 | 2026-10-29 | Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions. | |
CVE-2026-65499 |
medium | 6.5 | 0.0027 | 2026-10-29 | Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions. | |
CVE-2026-65501 |
medium | 5.3 | 0.0031 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= | |
CVE-2026-65506 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by So | |
CVE-2026-65512 |
medium | 5.4 | 0.0014 | 2026-10-29 | Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress | |
CVE-2026-65514 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions. | |
CVE-2026-65518 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 v | |
CVE-2026-65519 |
medium | 6.5 | 0.0022 | 2026-10-29 | Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. | |
CVE-2026-65521 |
medium | 5.3 | 0.0033 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions. | |
CVE-2026-65522 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Educati | |
CVE-2026-65524 |
medium | 4.3 | 0.0027 | 2026-10-29 | Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. | |
CVE-2026-65525 |
medium | 5.3 | 0.0029 | 2026-10-29 | Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. | |
CVE-2026-65527 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions. | |
CVE-2026-65528 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. | |
CVE-2026-65529 |
medium | 5.3 | 0.0031 | 2026-10-29 | Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Ele | |
CVE-2026-65531 |
medium | 4.8 | 0.0022 | 2026-10-29 | Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. | |
CVE-2026-65533 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. | |
CVE-2026-65534 |
medium | 5.9 | 0.0024 | 2026-10-29 | Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 ver | |
CVE-2026-65535 |
medium | 4.3 | 0.0029 | 2026-10-29 | Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions. | |
CVE-2026-65536 |
medium | 6.5 | 0.0017 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز | |
CVE-2026-65537 |
medium | 4.3 | 0.0025 | 2026-10-29 | Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and fil | |
CVE-2026-65538 |
medium | 5.9 | 0.0024 | 2026-10-29 | Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. | |
CVE-2026-65550 |
medium | 5.9 | 0.0024 | 2026-10-29 | Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. | |
CVE-2026-65898 |
medium | 5.1 | 0.0021 | 2026-10-29 | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used | |
CVE-2026-65899 |
medium | 5.1 | 0.0041 | 2026-10-29 | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearCo | |
CVE-2026-65900 |
medium | 5.1 | 0.0031 | 2026-10-29 | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES toget | |
CVE-2026-65901 |
medium | 5.1 | 0.0029 | 2026-10-29 | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode tha | |
CVE-2026-65902 |
medium | 5.3 | 0.0036 | 2026-10-29 | DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS a | |
CVE-2026-65903 |
medium | 5.1 | 0.0032 | 2026-10-29 | DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit | |
CVE-2026-65911 |
medium | 5.1 | 0.0033 | 2026-10-29 | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPu |