Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
5.3 MEDIUM
CVE-2026-78291 — WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.

Remote | Authorization
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
6.5 MEDIUM
CVE-2026-78290 — WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.

magazine_blocks | Remote | Cross-Site Scripting
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
4.3 MEDIUM
CVE-2026-78280 — WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.

hash_form | Remote | Cross-Site Request Forgery
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
5.4 MEDIUM
CVE-2026-78279 — WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerab…

Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.

Remote | Cross-Site Request Forgery
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
5.3 MEDIUM
CVE-2026-78278 — WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) v…

Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.

Remote | Authorization
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
4.9 MEDIUM
CVE-2026-78277 — WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerabili…

Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.

Remote | Server-Side Request Forgery
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
5.4 MEDIUM
CVE-2026-78272 — WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.

Remote | Authorization
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
7.6 HIGH
CVE-2026-78270 — WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability

Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.

Remote | Injection
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
6.4 MEDIUM
CVE-2026-78269 — WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.

shared_files | Remote | Server-Side Request Forgery
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
5.3 MEDIUM
CVE-2026-78258 — WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.

Remote | Authorization
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
7.5 HIGH
CVE-2026-78246 — itsourcecode Online Clinic Management System Admin Login login.php sql injection

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulatio…

Remote | Injection
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
7.1 HIGH
CVE-2026-6017 — Missing Authentication for Critical Function in KAON PG5298

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal.   This vuln…

| Information Disclosure
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
8.1 HIGH
CVE-2026-66671 — WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.

Remote | Path Traversal
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
8.1 HIGH
CVE-2026-66670 — WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Måne <= 1.7 versions.

Remote | Path Traversal
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
9.8 CRITICAL
CVE-2026-66650 — WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

Remote | Injection
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
9.8 CRITICAL
CVE-2026-66648 — WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.

Remote | Authentication
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
7.1 HIGH
CVE-2026-66623 — WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnera…

Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.

Remote | Cross-Site Scripting
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
7.1 HIGH
CVE-2026-66610 — WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.

Remote | Cross-Site Scripting
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
7.1 HIGH
CVE-2026-66599 — WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.

Remote | Cross-Site Scripting
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
9.8 CRITICAL
CVE-2026-66587 — WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

Remote | Path Traversal
Aug 24, 2026 Aug 24, 2026
Aug 24, 2026
Aug 24, 2026
Showing 20 of 11415 Results