Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.5 HIGH
CVE-2026-61984 — WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

wpmobile.app | Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.5 HIGH
CVE-2026-61980 — WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

Remote | Path Traversal
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
8.1 HIGH
CVE-2026-61979 — WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

saml_sp_single_sign_on | Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.5 MEDIUM
CVE-2026-61978 — WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken…

Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-61974 — WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.3 CRITICAL
CVE-2026-61969 — WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.8 CRITICAL
CVE-2026-61967 — WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.3 CRITICAL
CVE-2026-61966 — WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability

Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-61965 — WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
10.0 CRITICAL
CVE-2026-61962 — WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability

Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-61960 — WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.4 HIGH
CVE-2026-28189 — WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.3 HIGH
CVE-2026-28188 — WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-28187 — WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - …

Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
8.1 HIGH
CVE-2026-28186 — WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.8 CRITICAL
CVE-2026-28185 — WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
8.5 HIGH
CVE-2026-28184 — WordPress Form Maker by 10Web plugin <= 1.15.44 - SQL Injection vulnerability

Subscriber SQL Injection in Form Maker by 10Web <= 1.15.44 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.5 MEDIUM
CVE-2026-28182 — WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Cross Site Scripting (XSS) vulne…

Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.5 MEDIUM
CVE-2026-28181 — WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerabil…

Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
8.8 HIGH
CVE-2026-28176 — WordPress Booking Activities plugin <= 1.18.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
Showing 20 of 11201 Results