Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
9.8 CRITICAL
CVE-2026-73996 — WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.

Remote | Authentication
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
5.4 MEDIUM
CVE-2026-73995 — WordPress User Registration plugin <= 5.2.6 - Broken Authentication vulnerability

Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

user_registration | Remote | Authentication
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.5 HIGH
CVE-2026-73994 — WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Remote | Authorization
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
4.6 MEDIUM
CVE-2026-73426 — Trix: Stored XSS vulnerability through serialized attributes

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the…

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
6.5 MEDIUM
CVE-2026-73404 — WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.

Remote | Authorization
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
8.1 HIGH
CVE-2026-73400 — WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerabil…

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Remote | Path Traversal
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
6.5 MEDIUM
CVE-2026-73399 — WordPress Flutterwave WooCommerce plugin <= 3.3.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.

Remote | Authentication
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
6.5 MEDIUM
CVE-2026-73398 — WordPress Piraeus Bank WooCommerce Payment Gateway plugin 3.2.0 - Broken Authentication v…

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.

piraeus_bank_woocommerce_payment_gateway | Remote | Authentication
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
9.8 CRITICAL
CVE-2026-73397 — WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

Remote | Authentication
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.1 HIGH
CVE-2026-73396 — WordPress MWB HubSpot for WooCommerce plugin <= 1.6.7 - Broken Authentication vulnerabili…

Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.

Remote | Authentication
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
6.5 MEDIUM
CVE-2026-73395 — WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct…

Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.

Remote | Authorization
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.1 HIGH
CVE-2026-73393 — WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
9.3 CRITICAL
CVE-2026-73392 — WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions.

Remote | Injection
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
4.9 MEDIUM
CVE-2026-73383 — WordPress CTX Feed plugin <= 6.6.47 - Arbitrary File Download vulnerability

Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.

Remote | Path Traversal
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.1 HIGH
CVE-2026-73382 — WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.

site_reviews | Remote | Cross-Site Scripting
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
9.1 CRITICAL
CVE-2026-73381 — WordPress Popup by Supsystic plugin <= 1.13.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Remote | Authentication
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
9.8 CRITICAL
CVE-2026-73380 — WordPress Popup by Supsystic plugin <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

Remote | Injection
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
6.5 MEDIUM
CVE-2026-73379 — WordPress Contact Form by Supsystic plugin < 1.10.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.

Remote | Authentication
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.1 HIGH
CVE-2026-73378 — WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerab…

Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.5 HIGH
CVE-2026-73377 — WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

Remote | Authorization
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
Showing 20 of 11188 Results