Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.1 HIGH
CVE-2026-42693 — WordPress Jannah theme <= 7.6.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.

jannah | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.5 HIGH
CVE-2026-42633 — WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability

Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42632 — WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42631 — WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.5 HIGH
CVE-2026-42630 — WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure v…

Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.

Remote | Information Disclosure
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
5.9 MEDIUM
CVE-2026-42419 — WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

Remote | Information Disclosure
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
6.5 MEDIUM
CVE-2026-40808 — WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.7 HIGH
CVE-2026-40805 — WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

peepso | Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-40803 — WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.6 HIGH
CVE-2026-40802 — WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability

Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-40801 — WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

wordable | Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.3 CRITICAL
CVE-2026-40800 — WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5…

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-40777 — WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-39802 — WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

everest_backup | Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-39801 — WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-39800 — WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting …

Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

additional_order_filters_for_woocommerce | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-39799 — WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

wp_file_download | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.2 HIGH
CVE-2026-27350 — WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

builderius | Remote | Server-Side Request Forgery
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
6.3 MEDIUM
CVE-2026-108604 — Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by sub…

| Authorization
Oct 10, 2026 Oct 16, 2026
Oct 10, 2026
Oct 16, 2026
4.8 MEDIUM
CVE-2026-108603 — slide-maker through 5.8.0 Path Traversal via generate_images_openai.py

slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames.…

| Path Traversal
Oct 10, 2026 Oct 16, 2026
Oct 10, 2026
Oct 16, 2026
Showing 20 of 14135 Results