Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.1 HIGH
CVE-2026-104672 — WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104670 — WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

learnpress | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.3 HIGH
CVE-2026-104406 — WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.1 HIGH
CVE-2026-104405 — WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.9 MEDIUM
CVE-2026-104399 — WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104395 — WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104394 — WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.2 HIGH
CVE-2026-104387 — WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

powerpress_podcasting | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-104385 — WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

groundhogg | Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-103346 — WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabil…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects…

payment_gateway | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-102915 — WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-102387 — WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.3 MEDIUM
CVE-2026-100518 — WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

advanced_google_recaptcha | Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-85153 — Information Disclosure Vulnerability in Schmooze dating mobile Application

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerabi…

Remote | Cryptography
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105807 — SourceCodester Simple Student Information System searchquery.php sql injection

A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The at…

simple_student_information_system | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.4 MEDIUM
CVE-2026-105305 — Keycloak-services: keycloak-services: device authorization grant bypasses per-client mini…

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security toke…

single_sign-on build_of_keycloak | Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-94299 — elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Ca…

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers t…

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.8 CRITICAL
CVE-2026-94293 — Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

aas_edge_client | Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.5 MEDIUM
CVE-2026-94278 — File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename …

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.3 MEDIUM
CVE-2026-94271 — Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverif…

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status…

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16713 Results