Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
10.0 CRITICAL
CVE-2026-81779 — WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48.

Remote | Injection
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
6.5 MEDIUM
CVE-2026-81778 — WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

Remote | Cross-Site Scripting
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
7.1 HIGH
CVE-2026-81768 — WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

Remote | Cross-Site Scripting
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
7.1 HIGH
CVE-2026-81765 — WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

Remote | Cross-Site Scripting
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
7.1 HIGH
CVE-2026-81764 — WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

Remote | Cross-Site Scripting
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
9.3 CRITICAL
CVE-2026-81763 — WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.

Remote | Injection
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
6.5 MEDIUM
CVE-2026-81762 — WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.

Remote | Authorization
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
6.3 MEDIUM
CVE-2026-81758 — WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.

Remote | Authorization
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
9.3 CRITICAL
CVE-2026-81756 — WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vuln…

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.

Remote | Injection
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
7.1 HIGH
CVE-2026-81298 — WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

Remote | Cross-Site Scripting
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
7.5 HIGH
CVE-2026-81297 — WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Privilege Escalation vulnerabil…

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

Remote | Authorization
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
7.5 HIGH
CVE-2026-81296 — WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerabi…

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

Remote | Authorization
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
9.3 CRITICAL
CVE-2026-81293 — WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.

Remote | Injection
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
7.1 HIGH
CVE-2026-81291 — WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

Remote | Cross-Site Scripting
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
7.1 HIGH
CVE-2026-81290 — WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) v…

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

Remote | Cross-Site Scripting
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
8.5 HIGH
CVE-2026-81287 — WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability

Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

Remote | Injection
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
6.5 MEDIUM
CVE-2026-81280 — WordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sen…

Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.

Remote | Information Disclosure
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
5.4 MEDIUM
CVE-2026-81278 — WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1.

post_smtp | Remote | Authorization
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
0.0 NA
CVE-2026-79483 — FastGPT NoSQL Injection Vulnerability

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators …

| Injection
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
0.0 NA
CVE-2026-79408 — MetaGPT OS Command Injection Vulnerability

An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py.

| Injection
Aug 31, 2026 Aug 31, 2026
Aug 31, 2026
Aug 31, 2026
Showing 20 of 12144 Results