Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
9.9 CRITICAL
CVE-2026-39755 — WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.

Remote | Misconfiguration
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39754 — WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnera…

Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.

Remote | Path Traversal
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.8 CRITICAL
CVE-2026-39753 — WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.7 HIGH
CVE-2026-39752 — WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.

Remote | Path Traversal
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-39751 — WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vuln…

Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39750 — WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checko…

Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39749 — WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39748 — WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

edumall | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-39747 — WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability

Subscriber SQL Injection in Woffice <= 5.4.35 versions.

woffice | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-39746 — WordPress Booknetic plugin <= 4.8.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.

booknetic | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39745 — WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) …

Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39731 — WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39730 — WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

wise_chat | Remote | Authorization
Oct 06, 2026 Oct 07, 2026
Oct 06, 2026
Oct 07, 2026
7.2 HIGH
CVE-2026-39729 — WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

edwiser_bridge | Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.2 HIGH
CVE-2026-39728 — WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerabi…

Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

Remote | Server-Side Request Forgery
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39727 — WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39726 — WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabil…

Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39724 — WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerabili…

Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39722 — WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

wordpress_learning_management_system | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39720 — WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

mapster_wp_maps | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16722 Results