Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-85641 — Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Paramet…

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to s…

| Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-85572 — Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure

The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, t…

| Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-85569 — Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Miscl…

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API cre…

| Authentication
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-85530 — GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthent…

| Authentication
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-85349 — FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR

The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber wi…

| Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-85131 — WPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRF

The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items …

| Cross-Site Request Forgery
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-84907 — Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpo…

The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated vi…

| Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-84905 — Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation

The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPres…

| Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-84829 — Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attribu…

| Cross-Site Scripting
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-84088 — Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing us…

| Cross-Site Scripting
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-82126 — Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content …

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the cont…

| Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-82125 — Schema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Co…

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthentic…

| Information Disclosure
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-82124 — Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Co…

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing u…

| Information Disclosure
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-78474 — Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure …

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retri…

| Authentication
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-78472 — Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection att…

| Injection
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-77702 — Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to repla…

| Authorization
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-76559 — WP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL Handling

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrat…

| Server-Side Request Forgery
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-76558 — WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowi…

| Cross-Site Scripting
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-76557 — WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an admin…

| Injection
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
0.0 NA
CVE-2026-76556 — WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permiss…

| Injection
Sep 16, 2026 Sep 16, 2026
Sep 16, 2026
Sep 16, 2026
Showing 20 of 14339 Results