Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-32571 — WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-32570 — WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting …

Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-32569 — WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

wp_media_folder | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.9 CRITICAL
CVE-2026-32568 — WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnera…

Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-32557 — WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-25434 — WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability

Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-25433 — WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability

Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-105879 — WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulner…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElement…

jetelements_for_elementor | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.0 MEDIUM
CVE-2026-105809 — SourceCodester Simple Student Information System Profile Field register.php cross site sc…

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. Th…

simple_student_information_system | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
4.0 MEDIUM
CVE-2026-105808 — SourceCodester Simple Student Information System searchresults.php clean cross site scrip…

A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the ar…

simple_student_information_system | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 09, 2026
Oct 06, 2026
Oct 09, 2026
8.5 HIGH
CVE-2026-105317 — WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability

Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.

paid_membership_subscriptions | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105071 — WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive D…

Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.8 HIGH
CVE-2026-105070 — WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions.

salon_booking_system | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-105061 — WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-105059 — WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerab…

Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue …

Remote | Authorization
Oct 06, 2026 Oct 12, 2026
Oct 06, 2026
Oct 12, 2026
8.8 HIGH
CVE-2026-105058 — WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.3 MEDIUM
CVE-2026-105057 — WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104814 — WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.2 HIGH
CVE-2026-104757 — WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vu…

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.1 HIGH
CVE-2026-104747 — WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16721 Results