Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
9.8 CRITICAL
CVE-2026-62011 — WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62010 — WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62009 — WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62008 — WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62006 — WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62005 — WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62004 — WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62003 — WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62002 — WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-62001 — WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-61998 — WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-61997 — WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
8.5 HIGH
CVE-2026-61996 — WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-61995 — WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-61993 — WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

blockonomics | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
9.8 CRITICAL
CVE-2026-61992 — WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

Remote | Injection
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
10.0 CRITICAL
CVE-2026-61991 — WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

Remote | Authentication
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-61989 — WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerabil…

Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

easy_property_listings | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-61988 — WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (…

Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
7.1 HIGH
CVE-2026-54866 — WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting…

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

razorpay_payment_button | Remote | Cross-Site Scripting
Oct 29, 2026 Oct 29, 2026
Oct 29, 2026
Oct 29, 2026
Showing 20 of 17041 Results