Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
8.5 HIGH
CVE-2026-42712 — WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42711 — WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

slider | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42709 — WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 -…

Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.5 HIGH
CVE-2026-42706 — WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.5 HIGH
CVE-2026-42705 — WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-42704 — WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42702 — WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

tutor_lms | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42699 — WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42697 — WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scriptin…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.…

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
10.0 CRITICAL
CVE-2026-42696 — WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code…

Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning sitevault-backup-restore-migration allows Remote Code Inc…

Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42693 — WordPress Jannah theme <= 7.6.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.

jannah | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.5 HIGH
CVE-2026-42633 — WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability

Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42632 — WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-42631 — WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.5 HIGH
CVE-2026-42630 — WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure v…

Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.

Remote | Information Disclosure
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
5.9 MEDIUM
CVE-2026-42419 — WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

Remote | Information Disclosure
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
6.5 MEDIUM
CVE-2026-40808 — WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.7 HIGH
CVE-2026-40805 — WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

peepso | Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-40803 — WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.6 HIGH
CVE-2026-40802 — WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability

Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
Showing 20 of 14145 Results