Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.2 HIGH
CVE-2026-15052 — MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthent…

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, …

Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
5.3 MEDIUM
CVE-2026-15018 — Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-alg…

The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 due to insufficien…

Remote | Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-13458 — GenerateBlocks <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dy…

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input…

generateblocks | Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
5.3 MEDIUM
CVE-2026-11995 — Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Bu…

The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.9…

Remote | Authorization
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
4.3 MEDIUM
CVE-2026-10782 — RealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Mem…

The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not properly verifying that a user is autho…

Remote | Authorization
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
5.3 MEDIUM
CVE-2025-14073 — WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the `…

paypal_payments | Remote | Information Disclosure
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
4.3 MEDIUM
CVE-2026-2916 — Jeg Kit for Elementor <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Infor…

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class…

jeg_elementor_kit | Remote | Information Disclosure
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.8 HIGH
CVE-2026-15988 — AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI S…

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or in…

ai_engine | Remote | Cross-Site Request Forgery
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
4.3 MEDIUM
CVE-2025-14469 — Theme Editor <= 3.1 - Cross-Site Request Forgery to CSS Modification

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the ms_update AJAX action. This…

theme_editor | Remote | Cross-Site Request Forgery
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-15932 — Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal

The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allo…

| Path Traversal
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-15368 — Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registra…

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers…

profile_builder | Authentication
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-15262 — Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with con…

| Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-15244 — HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File I…

The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager …

Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-15234 — Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributo…

| Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-14840 — YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing

The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, all…

yop_poll | Authentication
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-14839 — Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full con…

| Authorization
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-14836 — Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Lim…

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source a…

| Authentication
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-14823 — Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification …

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to ov…

| Authorization
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-14822 — Event Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status Manipulation

The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change th…

| Authorization
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
0.0 NA
CVE-2026-14596 — DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Li…

The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers …

| Server-Side Request Forgery
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
Showing 20 of 9318 Results