Browse All CVEs
50,424 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-57652 |
medium | 5.3 | 0.0031 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions | |
CVE-2026-57651 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions. | |
CVE-2026-57650 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions. | |
CVE-2026-57649 |
medium | 4.3 | 0.0027 | 2026-10-29 | Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions. | |
CVE-2026-57648 |
medium | 4.3 | 0.0025 | 2026-10-29 | Contributor Broken Access Control in Nelio Content <= 4.3.4 versions. | |
CVE-2026-57647 |
high | 7.5 | 0.0043 | 2026-10-29 | Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1 | |
CVE-2026-57646 |
medium | 5.4 | 0.0023 | 2026-10-29 | Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions. | |
CVE-2026-57645 |
high | 8.1 | 0.0035 | 2026-10-29 | newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions. | |
CVE-2026-57644 |
high | 8.5 | 0.0036 | 2026-10-29 | Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions. | |
CVE-2026-57643 |
high | 8.5 | 0.0036 | 2026-10-29 | Contributor SQL Injection in WP Post Author <= 3.9.1 versions. | |
CVE-2026-57642 |
high | 8.5 | 0.0036 | 2026-10-29 | Contributor SQL Injection in Gallery <= 4.7.8 versions. | |
CVE-2026-57641 |
medium | 6.5 | 0.0017 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions. | |
CVE-2026-57640 |
medium | 4.3 | 0.0025 | 2026-10-29 | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions. | |
CVE-2026-57638 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions. | |
CVE-2026-57637 |
medium | 4.3 | 0.0014 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce < | |
CVE-2026-57636 |
high | 8.5 | 0.0036 | 2026-10-29 | Contributor SQL Injection in wpForo Forum <= 3.0.9 versions. | |
CVE-2026-57635 |
medium | 6.5 | 0.0017 | 2026-10-29 | Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe | |
CVE-2026-57634 |
medium | 4.3 | 0.0025 | 2026-10-29 | Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions. | |
CVE-2026-57633 |
medium | 5.3 | 0.0033 | 2026-10-29 | Unauthenticated Sensitive Data Exposure in WCBoost – Products Compare <= 1.1.0 versi | |
CVE-2026-57632 |
medium | 5.4 | 0.0029 | 2026-10-29 | Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 | |
CVE-2026-57631 |
high | 7.6 | 0.0038 | 2026-10-29 | Administrator SQL Injection in Popup box <= 6.0.1 versions. | |
CVE-2026-57630 |
medium | 5.3 | 0.0031 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.4 | |
CVE-2026-57627 |
medium | 4.9 | 0.0019 | 2026-10-29 | Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions. | |
CVE-2026-57622 |
medium | 4.3 | 0.0027 | 2026-10-29 | Subscriber Broken Access Control in WPCafe <= 3.0.14 versions. | |
CVE-2026-57618 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions. | |
CVE-2026-57617 |
medium | 6.5 | 0.0022 | 2026-10-29 | Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions. | |
CVE-2026-57527 |
high | 8.7 | 0.0068 | 2026-10-29 | Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserializat | |
CVE-2026-57431 |
medium | 6.5 | 0.0022 | 2026-10-29 | Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions. | |
CVE-2026-57430 |
medium | 4.3 | 0.0025 | 2026-10-29 | Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions. | |
CVE-2026-57325 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions. | |
CVE-2026-57324 |
medium | 6.5 | 0.0033 | 2026-10-29 | Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions. | |
CVE-2026-57323 |
medium | 5.8 | 0.0031 | 2026-10-29 | Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions. | |
CVE-2026-57322 |
high | 7.1 | 0.0025 | 2026-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne | |
CVE-2026-57321 |
high | 7.1 | 0.0041 | 2026-10-29 | Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions. | |
CVE-2026-57319 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions. | |
CVE-2026-57318 |
medium | 6.5 | 0.0037 | 2026-10-29 | Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. | |
CVE-2026-57317 |
high | 7.1 | 0.0023 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 ver | |
CVE-2026-57316 |
medium | 6.5 | 0.0037 | 2026-10-29 | Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions. | |
CVE-2026-57315 |
high | 8.5 | 0.0058 | 2026-10-29 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions. | |
CVE-2026-57312 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions. | |
CVE-2026-56773 |
high | 8.7 | 0.0054 | 2026-10-29 | Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing an | |
CVE-2026-56072 |
high | 7.1 | 0.0025 | 2026-10-29 | Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions. | |
CVE-2026-56070 |
critical | 9.3 | 0.0144 | 2026-10-29 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. | |
CVE-2026-56069 |
high | 7.5 | 0.0043 | 2026-10-29 | Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versio | |
CVE-2026-56068 |
critical | 9.3 | 0.0040 | 2026-10-29 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. | |
CVE-2026-56067 |
critical | 9.3 | 0.0045 | 2026-10-29 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. | |
CVE-2026-56066 |
medium | 5.8 | 0.0047 | 2026-10-29 | Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions. | |
CVE-2026-56064 |
high | 8.5 | 0.0036 | 2026-10-29 | Subscriber SQL Injection in Tourfic <= 2.22.5 versions. | |
CVE-2026-56063 |
high | 8.3 | 0.0030 | 2026-10-29 | Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions. | |
CVE-2026-56062 |
critical | 9.3 | 0.0144 | 2026-10-29 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. |