Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
9.8 CRITICAL
CVE-2026-66424 — WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerabil…

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.7 HIGH
CVE-2026-65582 — WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.

Remote | Path Traversal
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-65580 — WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.5 HIGH
CVE-2026-61984 — WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

wpmobile.app | Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.5 HIGH
CVE-2026-61980 — WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

Remote | Path Traversal
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
8.1 HIGH
CVE-2026-61979 — WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

saml_sp_single_sign_on | Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.5 MEDIUM
CVE-2026-61978 — WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken…

Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-61974 — WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.3 CRITICAL
CVE-2026-61969 — WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.8 CRITICAL
CVE-2026-61967 — WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.3 CRITICAL
CVE-2026-61966 — WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability

Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-61965 — WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
10.0 CRITICAL
CVE-2026-61962 — WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability

Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-61960 — WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.5 HIGH
CVE-2026-48702 — Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and…

Remote | Denial of Service
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.4 HIGH
CVE-2026-28189 — WordPress Participants Database plugin <= 2.7.8.4 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.3 HIGH
CVE-2026-28188 — WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-28187 — WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - …

Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
8.1 HIGH
CVE-2026-28186 — WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.8 CRITICAL
CVE-2026-28185 — WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
Showing 20 of 11209 Results