Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.3 HIGH
CVE-2026-95526 — WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

bear_-_woocommerce_bulk_editor_and_products_manager_professional | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.2 HIGH
CVE-2026-95105 — Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery b…

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make i…

cloak | Remote | Cryptography
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-94675 — WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vuln…

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.3 MEDIUM
CVE-2026-94206 — Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured sec…

cloak cloak_ecto | Remote | Cryptography
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.8 HIGH
CVE-2026-62072 — WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

progress_planner | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.8 HIGH
CVE-2026-4889 — SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies

SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to bo…

eloanapp_platform | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-48199 — WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.2 HIGH
CVE-2026-48197 — WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a t…

capabilities | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-42638 — WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digi…

easy_digital_downloads | Remote | Authorization
Oct 06, 2026 Oct 07, 2026
Oct 06, 2026
Oct 07, 2026
6.5 MEDIUM
CVE-2026-42637 — WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerabil…

Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-42636 — WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site…

Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-42635 — WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulne…

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-42634 — WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.…

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-42418 — WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: f…

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 07, 2026
Oct 06, 2026
Oct 07, 2026
9.3 CRITICAL
CVE-2026-42417 — WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-42416 — WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability

Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-42415 — WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-42414 — WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

listingpro | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-42413 — WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive…

Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-41562 — WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16314 Results