Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
9.3 CRITICAL
CVE-2026-39795 — WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability

Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.

sendpress | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-39794 — WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access …

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.8 HIGH
CVE-2026-39793 — WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.6 HIGH
CVE-2026-39792 — WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

simple_file_list | Remote | Path Traversal
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.3 MEDIUM
CVE-2026-39791 — WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39790 — WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a throu…

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 08, 2026
Oct 06, 2026
Oct 08, 2026
6.5 MEDIUM
CVE-2026-39788 — WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39787 — WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-39785 — WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmed…

Remote | Injection
Oct 06, 2026 Oct 13, 2026
Oct 06, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-39784 — WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

hotel_booking | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39781 — WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document G…

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 15, 2026
Oct 06, 2026
Oct 15, 2026
7.1 HIGH
CVE-2026-39780 — WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39778 — WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2…

Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.0 HIGH
CVE-2026-39776 — WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.8 HIGH
CVE-2026-39775 — WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulner…

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.8 HIGH
CVE-2026-39774 — WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
10.0 CRITICAL
CVE-2026-39773 — WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.3 MEDIUM
CVE-2026-39772 — WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-39771 — WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
10.0 CRITICAL
CVE-2026-39770 — WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16721 Results