Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.5 HIGH
CVE-2026-105071 — WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive D…

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.8 HIGH
CVE-2026-105070 — WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

salon_booking_system | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-105061 — WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-105059 — WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerab…

Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue …

Remote | Authorization
Oct 06, 2026 Oct 12, 2026
Oct 06, 2026
Oct 12, 2026
8.8 HIGH
CVE-2026-105058 — WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.3 MEDIUM
CVE-2026-105057 — WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104814 — WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.2 HIGH
CVE-2026-104757 — WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vu…

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.1 HIGH
CVE-2026-104747 — WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104672 — WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104670 — WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

learnpress | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.3 HIGH
CVE-2026-104406 — WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.1 HIGH
CVE-2026-104405 — WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.9 MEDIUM
CVE-2026-104399 — WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104395 — WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104394 — WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.2 HIGH
CVE-2026-104387 — WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

powerpress_podcasting | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-104385 — WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

groundhogg | Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-103346 — WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabil…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects…

payment_gateway | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-102915 — WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16721 Results