Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.5 HIGH
CVE-2026-66461 — WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerabil…

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.5 MEDIUM
CVE-2026-66460 — WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.5 MEDIUM
CVE-2026-66459 — WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.3 CRITICAL
CVE-2026-66458 — WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.5 MEDIUM
CVE-2026-66456 — WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS…

Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.0 MEDIUM
CVE-2026-66455 — WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.5 MEDIUM
CVE-2026-66454 — WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.8 CRITICAL
CVE-2026-66453 — WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.

Remote | Authentication
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
8.1 HIGH
CVE-2026-66450 — WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.

Remote | Path Traversal
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-66449 — WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.3 CRITICAL
CVE-2026-66446 — WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerabil…

Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
6.5 MEDIUM
CVE-2026-66444 — WordPress Payment Forms for Paystack plugin <= 4.0.5 - Sensitive Data Exposure vulnerabil…

Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.

Remote | Information Disclosure
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.5 HIGH
CVE-2026-66443 — WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

Remote | Information Disclosure
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.5 HIGH
CVE-2026-66441 — WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
9.3 CRITICAL
CVE-2026-66436 — WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerab…

Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.5 HIGH
CVE-2026-66432 — WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.

Remote | Information Disclosure
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.5 HIGH
CVE-2026-66431 — WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 -…

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.

Remote | Authorization
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
8.5 HIGH
CVE-2026-66430 — WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulner…

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

Remote | Injection
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-66429 — WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - Cross Site Scripting…

Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
7.1 HIGH
CVE-2026-66426 — WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.

Remote | Cross-Site Scripting
Aug 13, 2026 Aug 13, 2026
Aug 13, 2026
Aug 13, 2026
Showing 20 of 11209 Results