CVEs
Most recently published first. Full-text search is on the roadmap.
Year
Want to know when one of these hits your stack? Track the products you run and get alerted.
Create a free account| CVE | Severity | Published | Title |
|---|---|---|---|
| CVE-2026-123776 | N/A | 7 Nov 2026 | RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process |
| CVE-2026-93429 | HIGH7.2 | 7 Nov 2026 | VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter |
| CVE-2026-121977 | MEDIUM5.4 | 7 Nov 2026 | JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property |
| CVE-2026-120509 | MEDIUM4.7 | 7 Nov 2026 | Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter |
| CVE-2026-115548 | HIGH7.2 | 7 Nov 2026 | Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header |
| CVE-2026-111317 | HIGH7.2 | 7 Nov 2026 | JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source |
| CVE-2026-109214 | HIGH7.2 | 7 Nov 2026 | User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input |
| CVE-2026-111370 | HIGH7.2 | 7 Nov 2026 | WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters |
| CVE-2026-109991 | HIGH7.5 | 7 Nov 2026 | FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter |
| CVE-2026-104014 | CRITICAL9.8 | 7 Nov 2026 | Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization |
| CVE-2026-118050 | MEDIUM6.4 | 7 Nov 2026 | Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message |
| CVE-2026-118267 | HIGH8.1 | 7 Nov 2026 | WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert |
| CVE-2026-123418 | HIGH7.2 | 7 Nov 2026 | Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter |
| CVE-2026-121976 | MEDIUM6.4 | 7 Nov 2026 | Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter |
| CVE-2026-122231 | HIGH7.2 | 7 Nov 2026 | WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value |
| CVE-2026-120685 | MEDIUM5.4 | 7 Nov 2026 | Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain |
| CVE-2026-109230 | HIGH7.2 | 7 Nov 2026 | WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter |
| CVE-2026-93766 | HIGH7.2 | 7 Nov 2026 | Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter |
| CVE-2026-119075 | CRITICAL9.8 | 7 Nov 2026 | Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout |
| CVE-2026-104746 | HIGH8.1 | 7 Nov 2026 | Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta |
| CVE-2026-104768 | HIGH7.5 | 7 Nov 2026 | AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option |
| CVE-2026-120683 | MEDIUM5.4 | 7 Nov 2026 | Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter |
| CVE-2026-104760 | MEDIUM6.4 | 7 Nov 2026 | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute |
| CVE-2026-103914 | MEDIUM6.5 | 7 Nov 2026 | Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter |
| CVE-2026-119183 | HIGH7.2 | 7 Nov 2026 | JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta |
| CVE-2026-96565 | MEDIUM6.4 | 7 Nov 2026 | WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field |
| CVE-2026-116751 | HIGH7.5 | 7 Nov 2026 | Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys |
| CVE-2026-118066 | CRITICAL9.1 | 7 Nov 2026 | Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter |
| CVE-2026-122059 | MEDIUM6.4 | 7 Nov 2026 | WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute |
| CVE-2026-118056 | MEDIUM4.9 | 7 Nov 2026 | Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Parameter |
| CVE-2026-118047 | MEDIUM6.4 | 7 Nov 2026 | Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook |
| CVE-2026-116537 | HIGH7.2 | 7 Nov 2026 | Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter |
| CVE-2026-93755 | HIGH7.2 | 7 Nov 2026 | Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For Header |
| CVE-2026-102564 | MEDIUM6.5 | 7 Nov 2026 | Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer |
| CVE-2026-121265 | N/A | 7 Nov 2026 | SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update |
| CVE-2026-121571 | MEDIUM5.3 | 7 Nov 2026 | WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability |
| CVE-2026-119496 | MEDIUM5.3 | 7 Nov 2026 | WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability |
| CVE-2026-123470 | MEDIUM4.3 | 7 Nov 2026 | WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability |
| CVE-2026-119513 | MEDIUM5.3 | 7 Nov 2026 | WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability |
| CVE-2026-123468 | MEDIUM4.3 | 7 Nov 2026 | WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability |
| CVE-2026-120857 | MEDIUM5.3 | 7 Nov 2026 | WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability |
| CVE-2026-123148 | MEDIUM5.3 | 7 Nov 2026 | WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability |
| CVE-2026-120837 | MEDIUM4.3 | 7 Nov 2026 | WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability |
| CVE-2026-121724 | MEDIUM4.3 | 7 Nov 2026 | WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability |
| CVE-2026-120364 | MEDIUM6.5 | 7 Nov 2026 | WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-119523 | MEDIUM5.3 | 7 Nov 2026 | WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability |
| CVE-2026-119525 | MEDIUM4.3 | 7 Nov 2026 | WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability |
| CVE-2026-120365 | MEDIUM6.5 | 7 Nov 2026 | WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-119478 | MEDIUM4.3 | 7 Nov 2026 | WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability |
| CVE-2026-119508 | MEDIUM5.3 | 7 Nov 2026 | WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerability |