Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.1 HIGH
CVE-2026-90887 — WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.

Remote | Cross-Site Scripting
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
5.3 MEDIUM
CVE-2026-78528 — WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.

Remote | Authorization
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
8.8 HIGH
CVE-2026-78295 — WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions.

Remote | Cross-Site Request Forgery
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
6.5 MEDIUM
CVE-2026-78294 — WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

Remote | Cross-Site Scripting
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
5.3 MEDIUM
CVE-2026-74017 — WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.

user_registration | Remote | Authorization
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
5.4 MEDIUM
CVE-2026-74005 — WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnera…

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.

Remote | Cross-Site Request Forgery
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
5.3 MEDIUM
CVE-2026-74002 — WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.

Remote | Authorization
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
5.3 MEDIUM
CVE-2026-74000 — WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.

Remote | Authorization
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
5.4 MEDIUM
CVE-2026-73999 — WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.

Remote | Authorization
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
5.3 MEDIUM
CVE-2026-66676 — WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.

Remote | Authorization
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
7.6 HIGH
CVE-2026-66631 — WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability

Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.

Remote | Injection
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
7.6 HIGH
CVE-2026-66630 — WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.

Remote | Injection
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
7.6 HIGH
CVE-2026-66628 — WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.

wp-lister_lite_for_ebay | Remote | Injection
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
7.6 HIGH
CVE-2026-66626 — WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability

Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.

Remote | Injection
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
7.6 HIGH
CVE-2026-66625 — WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability

Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.

wc_vendors_marketplace | Remote | Injection
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
7.6 HIGH
CVE-2026-66624 — WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability

Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.

Remote | Injection
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
7.6 HIGH
CVE-2026-66619 — WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability

Administrator SQL Injection in Newsletters <= 4.18 versions.

newsletters | Remote | Injection
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
7.6 HIGH
CVE-2026-66618 — WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability

Administrator SQL Injection in WP Maps <= 4.9.9 versions.

Remote | Injection
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
6.5 MEDIUM
CVE-2026-66617 — WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.

Remote | Cross-Site Scripting
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
6.4 MEDIUM
CVE-2026-66608 — WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.…

Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.

Remote | Server-Side Request Forgery
Sep 17, 2026 Sep 17, 2026
Sep 17, 2026
Sep 17, 2026
Showing 20 of 14856 Results