Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
4.3 MEDIUM
CVE-2026-97267 — WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerab…

Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

Remote | Authorization
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
6.5 MEDIUM
CVE-2026-97266 — WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) …

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

Remote | Cross-Site Scripting
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
6.5 MEDIUM
CVE-2026-97262 — WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) …

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.

Remote | Cross-Site Scripting
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
5.3 MEDIUM
CVE-2026-97261 — WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

Remote | Information Disclosure
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
7.1 HIGH
CVE-2026-97253 — WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.…

Remote | Cross-Site Scripting
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
7.1 HIGH
CVE-2026-97250 — WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

Remote | Cross-Site Scripting
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
5.3 MEDIUM
CVE-2026-97249 — WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.

Remote | Authentication
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
9.8 CRITICAL
CVE-2026-97248 — WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

Remote | Injection
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
6.5 MEDIUM
CVE-2026-97247 — WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

blocksy_companion | Remote | Authorization
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
4.9 MEDIUM
CVE-2026-97246 — WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.

image_optimizer | Remote | Injection
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
7.2 HIGH
CVE-2026-97245 — WordPress SureCart plugin <= 4.7.2 - Privilege Escalation vulnerability

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

Remote | Authorization
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
7.5 HIGH
CVE-2026-97244 — WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

Remote | Path Traversal
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
5.4 MEDIUM
CVE-2026-97243 — WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability

Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

Remote | Authorization
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
6.8 MEDIUM
CVE-2026-97242 — WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability

Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.

Remote | Path Traversal
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
7.5 HIGH
CVE-2026-97241 — WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

Remote | Authentication
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
7.5 HIGH
CVE-2026-97240 — WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

Remote | Information Disclosure
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
6.5 MEDIUM
CVE-2026-97239 — WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

Remote | Authorization
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
5.5 MEDIUM
CVE-2026-97238 — WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

Remote | Cross-Site Scripting
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
7.1 HIGH
CVE-2026-97237 — WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

Remote | Cross-Site Scripting
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
6.5 MEDIUM
CVE-2026-97236 — WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

addons | Remote | Cross-Site Scripting
Sep 30, 2026 Sep 30, 2026
Sep 30, 2026
Sep 30, 2026
Showing 20 of 14819 Results