Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.7 HIGH
CVE-2026-125852 — WordPress Realtyna Organic IDX plugin plugin <= 5.4.2 - Arbitrary File Deletion vulnerabi…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Path Traversal.This issue …

realtyna_organic_idx_plugin | Remote | Path Traversal
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
9.9 CRITICAL
CVE-2026-125851 — WordPress Hotel Booking Lite theme <= 2.5.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: …

hotel_booking_lite | Remote | Misconfiguration
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
7.1 HIGH
CVE-2026-125837 — WordPress Make theme <= 1.10.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thethemefoundry Make make allows Reflected XSS.This issue affects Make: from n/a through 1.10.10.

make | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125835 — WordPress JetTabs plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through 2.3.5.

jettabs | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
4.3 MEDIUM
CVE-2026-125834 — WordPress Imagify plugin <= 2.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4.

imagify | Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125831 — WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.2 - Cross Site Scripting (XSS) …

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Sto…

powerpack_for_beaver_builder | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125827 — WordPress Event Tickets plugin <= 5.31.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: fro…

event_tickets | Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125825 — WordPress RepairBuddy plugin <= 4.1236 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n…

computer_repair_shop | Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125824 — WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a th…

wp_go_maps | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125821 — WordPress MapSVG plugin <= 9.0.4 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue…

mapsvg | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125819 — WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: fr…

gutenberg_blocks | Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
8.5 HIGH
CVE-2026-125811 — WordPress myCred plugin <= 4.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in myCred myCred mycred allows Blind SQL Injection.This issue affects myCred: from n/a through 4.0.2.

mycred | Remote | Injection
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
4.3 MEDIUM
CVE-2026-125810 — WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

mycred | Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125809 — WordPress myCred plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in myCred myCred mycred allows Stored XSS.This issue affects myCred: from n/a through 4.0.2.

mycred | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125808 — WordPress HT Mega plugin <= 3.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in HTMega HT Mega ht-mega-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HT Mega: from n/a through 3.2.8.

ht_mega | Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125807 — WordPress HT Mega plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a throu…

ht_mega | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125802 — WordPress Spectra plugin <= 2.20.5 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a …

spectra | Remote | Information Disclosure
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
6.5 MEDIUM
CVE-2026-125794 — WordPress Extension for Leaflet Map plugin <= 6.1.1 - Cross Site Scripting (XSS) vulnerab…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Exte…

extensions_for_leaflet_map | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
5.3 MEDIUM
CVE-2026-125792 — WordPress Church Admin plugin <= 5.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Andy Moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through 5…

church_admin | Remote | Authorization
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
7.1 HIGH
CVE-2026-125783 — WordPress Custom Post Types and Custom Fields creator – WCK plugin <= 2.4.0 - Cross Site …

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in madalin.ungureanu Custom Post Types and Custom Fields creator – WCK wck-custom-fields-and-custom-…

wck_custom_fields_and_custom_post_types_creator | Remote | Cross-Site Scripting
Nov 13, 2026 Nov 13, 2026
Nov 13, 2026
Nov 13, 2026
Showing 20 of 17137 Results