Latest CVE Vulnerabilities – Page 2

6.9 MEDIUM

CVE-2026-129478 — Assimp through 6.0.6 Heap Out-of-Bounds Read via glTF ParseDataURI

Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in glTFCommon::Util::ParseDataURI caused by storing the data offset in a signed char. Attackers can supply a crafted glTF file wi…

assimp | Memory Corruption

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

6.8 MEDIUM

CVE-2026-129477 — Assimp through 6.0.6 Path Traversal via glTF External Buffer URIs

Assimp through 6.0.6 contains a path traversal vulnerability in the glTF and glTF2 importers that allows attackers to read local files via crafted buffers[].uri values. Attackers can supply glTF mode…

assimp | Path Traversal

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

9.9 CRITICAL

CVE-2026-129453 — DrayTek Vigor2960 File Existence Check mainfunction.cgi check_file_exist heap-based overf…

A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a mani…

vigor2960_firmware vigor2960 | Remote | Memory Corruption

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

6.5 MEDIUM

CVE-2026-125857 — WordPress Dynamic User Directory plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dy…

dynamic_user_directory | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

8.5 HIGH

CVE-2026-125832 — WordPress WP Data Access plugin <= 5.5.92 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows SQL Injection.This issue affects…

wp_data_access wp_data_access | Remote | Injection

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125828 — WordPress BookIt plugin <= 2.6.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP BookIt bookit allows Stored XSS.This issue affects BookIt: from n/a throug…

bookit | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125813 — WordPress Survey Maker plugin <= 5.2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Reflected XSS.This issue affects Survey Maker: from n/a …

survey_maker | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

6.5 MEDIUM

CVE-2026-125805 — WordPress GeoDirectory plugin <= 2.8.204 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a…

geodirectory | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125791 — WordPress Orphans plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iWorks Orphans sierotki allows Stored XSS.This issue affects Orphans: from n/a through 3.4.6.

orphans | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125790 — WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.20 - Cross Site Scripting (…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Stored XSS.This issue affects Vi…

vikbooking_hotel_booking_engine_\&_pms | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125789 — WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.20 - Cross Site Scripting (…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Stored XSS.This issue affects Vi…

vikbooking_hotel_booking_engine_\&_pms | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.5 HIGH

CVE-2026-125780 — WordPress Woocommerce Custom Product Addons Pro plugin <= 5.9.0 - Arbitrary File Deletion…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce Custom Product Addons Pro woo-custom-product-addons-pro allows Path Traversal.This …

woocommerce_custom_product_addons_pro woo_custom_product_addons_pro | Remote | Path Traversal

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125775 — WordPress CRM Perks Forms plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflected XSS.This issue affects CRM Perks Forms…

crm_perks_forms | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

9.8 CRITICAL

CVE-2026-125769 — WordPress Advanced Form Integration plugin <= 2.11.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Privilege Escalation.This issue affects Advanced Form Integration: from n/a thro…

advanced_form_integration advanced_form_integration | Remote | Authorization

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125764 — WordPress e2pdf plugin <= 1.32.65 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.65.

e2pdf e2pdf | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

8.8 HIGH

CVE-2026-125449 — WordPress Testimonial Slider plugin <= 3.0.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Testimonial Slider testimonial-slider-and-showcase allows Object Injection.This issue affects Testimonial Slider: from n/a through 3.…

testimonial_slider_and_showcase | Remote | Injection

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125443 — WordPress WPJAM Basic plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows DOM-Based XSS.This issue affects WPJAM Basic: from n/a th…

wpjam_basic | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-124995 — WordPress Track, Analyze & Optimize by WP Tao plugin <= 1.3.1 - Cross Site Scripting (XSS…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Stored XSS.This issue affects T…

track_analyze_optimize_by_wp_tao | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

6.5 MEDIUM

CVE-2026-124755 — WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.4 - Cross Site Scripti…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome allow…

advanced_custom_fields | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-124270 — WordPress NEX-Forms plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-For…

nex-forms | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

Browse by Apps

Latest CVE Feed

Cookie Preferences