Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
9.8 CRITICAL
CVE-2026-62002 — WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62001 — WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-61998 — WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-61997 — WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
8.5 HIGH
CVE-2026-61996 — WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-61995 — WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-61993 — WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

blockonomics | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-61992 — WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
10.0 CRITICAL
CVE-2026-61991 — WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

Remote | Authentication
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-61989 — WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerabil…

Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

easy_property_listings | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-61988 — WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (…

Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-54866 — WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting…

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

razorpay_payment_button | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
6.5 MEDIUM
CVE-2026-54865 — WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vuln…

Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-54864 — WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54860 — WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54859 — WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54858 — WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54857 — WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-54856 — WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
5.3 MEDIUM
CVE-2026-48200 — WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Librar…

Remote | Information Disclosure
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
Showing 20 of 17200 Results