Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
8.1 HIGH
CVE-2026-62070 — WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-62069 — WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-62068 — WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-62067 — WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-62066 — WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-62065 — WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-62064 — WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-62054 — WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-62053 — WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-62052 — WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-62051 — WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-62050 — WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.5 HIGH
CVE-2026-62043 — WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposu…

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

contact_form_7_-_dynamic_text_extension | Remote | Information Disclosure
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.3 HIGH
CVE-2026-62038 — WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-62037 — WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

document_embedder | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
6.3 MEDIUM
CVE-2026-62035 — WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control …

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-62034 — WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cros…

Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.6 HIGH
CVE-2026-62033 — WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

Subscriber Settings Change in uListing <= 2.2.0 versions.

Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-62032 — WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

directorypress | Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.3 CRITICAL
CVE-2026-62031 — WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
Showing 20 of 14145 Results