Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
5.3 MEDIUM
CVE-2026-123861 — WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object …

Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access …

jet_form_builder_hierarchical_select | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.3 MEDIUM
CVE-2026-123860 — WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n…

jetformbuilder | Remote | Cross-Site Scripting
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.3 MEDIUM
CVE-2026-123483 — WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n…

jetformbuilder | Remote | Cross-Site Scripting
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
6.5 MEDIUM
CVE-2026-123477 — WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through …

jetengine | Remote | Cross-Site Scripting
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.3 MEDIUM
CVE-2026-123474 — WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Acces…

Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.Th…

premium_blocks_for_gutenburg | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
4.3 MEDIUM
CVE-2026-123467 — WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability

Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motor…

motors | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.3 MEDIUM
CVE-2026-123462 — WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

mycred | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.3 MEDIUM
CVE-2026-123183 — WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vuln…

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Code I…

woot | Remote | Cross-Site Scripting
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
6.5 MEDIUM
CVE-2026-122669 — WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: fro…

everest_forms | Remote | Cross-Site Scripting
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.3 MEDIUM
CVE-2026-122663 — WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.

curcy | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
4.3 MEDIUM
CVE-2026-122660 — WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPre…

floristpress | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.4 MEDIUM
CVE-2026-122659 — WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from…

fluent_booking | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
9.1 CRITICAL
CVE-2026-122041 — Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthent…

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_upl…

checkout_field_editor_for_woocommerce | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
6.5 MEDIUM
CVE-2026-121784 — WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. WpBookingly service-booking-manager allows Stored XSS.This issue affects WpBookin…

service_booking_manager | Remote | Cross-Site Scripting
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.3 MEDIUM
CVE-2026-121777 — WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Co…

cool_formkit_lite | Remote | Cross-Site Scripting
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.3 MEDIUM
CVE-2026-121775 — WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20.

curcy | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
6.5 MEDIUM
CVE-2026-121579 — WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-e…

unlimited_elements_for_elementor | Remote | Cross-Site Scripting
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
5.3 MEDIUM
CVE-2026-121575 — WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from…

wp_user_manager | Remote | Authorization
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
8.8 HIGH
CVE-2026-120841 — WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusio…

tour_booking_manager | Remote | Path Traversal
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
8.8 HIGH
CVE-2026-120839 — WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusio…

tour_booking_manager | Remote | Path Traversal
Nov 07, 2026 Nov 07, 2026
Nov 07, 2026
Nov 07, 2026
Showing 20 of 17104 Results