Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
8.1 HIGH
CVE-2026-48194 — WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-48193 — WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.6 HIGH
CVE-2026-45440 — WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

wp_ultimate_csv_importer | Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-42777 — WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-42724 — WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-42723 — WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.6 HIGH
CVE-2026-42722 — WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability

Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

frontend_admin | Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-42719 — WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-42718 — WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

booster_for_woocommerce | Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.6 HIGH
CVE-2026-42717 — WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability

Administrator SQL Injection in Leyka <= 3.32.3 versions.

leyka | Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-42716 — WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerabil…

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42715 — WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerabil…

Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

photo_gallery | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.5 HIGH
CVE-2026-42712 — WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42711 — WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

slider | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42709 — WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 -…

Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.5 HIGH
CVE-2026-42706 — WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.5 HIGH
CVE-2026-42705 — WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-42704 — WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42702 — WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

tutor_lms | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42699 — WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
Showing 20 of 14270 Results