Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-85302 — WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vuln…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WP…

Remote | Cross-Site Scripting
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.1 HIGH
CVE-2026-84848 — WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.

Remote | Cross-Site Scripting
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.5 HIGH
CVE-2026-84847 — WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

Remote | Authorization
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.1 HIGH
CVE-2026-84836 — WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR)…

Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.

Remote | Authorization
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
9.8 CRITICAL
CVE-2026-84834 — WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.

jobsearch | Remote | Injection
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
9.8 CRITICAL
CVE-2026-84814 — WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions.

Remote | Authorization
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
9.3 CRITICAL
CVE-2026-84813 — WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability

Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.

Remote | Injection
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.1 HIGH
CVE-2026-84812 — WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

Remote | Cross-Site Scripting
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
8.1 HIGH
CVE-2026-84779 — WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Acce…

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 versions.

Remote | Authorization
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.5 HIGH
CVE-2026-84778 — WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Atta…

Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration &amp; Cloning <= 6.65 versions.

Remote | Denial of Service
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.4 HIGH
CVE-2026-84777 — WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability

Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.

Remote | Authentication
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.5 HIGH
CVE-2026-84776 — WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.

Remote | Denial of Service
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
6.1 MEDIUM
CVE-2026-84774 — WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

wp_statistics | Remote | Cross-Site Scripting
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.2 HIGH
CVE-2026-84773 — WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.

Remote | Cross-Site Scripting
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
6.5 MEDIUM
CVE-2026-84769 — WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) …

Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.

Remote | Authorization
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
9.3 CRITICAL
CVE-2026-84768 — WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vuln…

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.

Remote | Injection
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
5.3 MEDIUM
CVE-2026-84767 — WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.

Remote | Authentication
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
5.9 MEDIUM
CVE-2026-84766 — WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.

Remote | Authentication
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.1 HIGH
CVE-2026-84765 — WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.

Remote | Cross-Site Scripting
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
7.1 HIGH
CVE-2026-84763 — WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.

Remote | Cross-Site Scripting
Sep 03, 2026 Sep 03, 2026
Sep 03, 2026
Sep 03, 2026
Showing 20 of 12655 Results