Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.4 HIGH
CVE-2026-66635 — WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions.

Remote | Cross-Site Request Forgery
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
4.3 MEDIUM
CVE-2026-66634 — WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vul…

Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

Remote | Authorization
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.1 HIGH
CVE-2026-66633 — WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulne…

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.1 HIGH
CVE-2026-66629 — WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
9.9 CRITICAL
CVE-2026-66627 — WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions.

Remote | Misconfiguration
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.5 HIGH
CVE-2026-66622 — WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability

Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

depicter_slider | Remote | Injection
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.1 HIGH
CVE-2026-66621 — WordPress Ultimate Dashboard plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard <= 3.11.2 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.2 HIGH
CVE-2026-66620 — WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Remote | Injection
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.2 HIGH
CVE-2026-32553 — WordPress OttoKit plugin <= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

Remote | Server-Side Request Forgery
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.5 HIGH
CVE-2026-32549 — WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

Remote | Authorization
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.1 HIGH
CVE-2026-32547 — WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

Remote | Cross-Site Scripting
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.5 HIGH
CVE-2026-32481 — WordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

Remote | Authentication
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
9.9 CRITICAL
CVE-2026-32474 — WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

Remote | Path Traversal
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.2 HIGH
CVE-2026-32473 — WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (S…

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

Remote | Server-Side Request Forgery
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.5 HIGH
CVE-2026-32472 — WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

Remote | Authorization
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
9.8 CRITICAL
CVE-2026-32470 — WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

Remote | Injection
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
0.0 NA
CVE-2026-75874 — Sandbox escape in the Remote Settings Client component

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154.

firefox | Misconfiguration
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
9.6 CRITICAL
CVE-2026-75783 — TRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflow

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler.…

tew-wlc100p | Memory Corruption
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
7.5 HIGH
CVE-2026-75778 — code-projects Task Management System Login Form index.php select_with_multiple_condition …

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Suc…

task_management_system | Remote | Injection
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
0.0 NA
CVE-2026-74990 — Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 …

Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect…

firefox | Memory Corruption
Aug 18, 2026 Aug 18, 2026
Aug 18, 2026
Aug 18, 2026
Showing 20 of 11475 Results