Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.5 HIGH
CVE-2026-39769 — WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Graphina <= 3.1.12 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39767 — WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability

Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.

Remote | Denial of Service
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39766 — WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

arforms | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.2 HIGH
CVE-2026-39765 — WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-39764 — WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 …

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39762 — WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken …

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Level…

autoship_cloud_for_woocommerce | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.8 CRITICAL
CVE-2026-39761 — WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.9 CRITICAL
CVE-2026-39759 — WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability

Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.

Remote | Misconfiguration
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39758 — WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.9 CRITICAL
CVE-2026-39757 — WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.

Remote | Misconfiguration
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39756 — WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnera…

Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.9 CRITICAL
CVE-2026-39755 — WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.

Remote | Misconfiguration
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39754 — WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnera…

Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.

Remote | Path Traversal
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.8 CRITICAL
CVE-2026-39753 — WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.7 HIGH
CVE-2026-39752 — WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.

Remote | Path Traversal
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-39751 — WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vuln…

Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39750 — WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checko…

Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39749 — WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39748 — WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

edumall | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-39747 — WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability

Subscriber SQL Injection in Woffice <= 5.4.35 versions.

woffice | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16724 Results