Latest CVE Vulnerabilities

7.5 HIGH

CVE-2026-125780 — WordPress Woocommerce Custom Product Addons Pro plugin <= 5.9.0 - Arbitrary File Deletion…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce Custom Product Addons Pro woo-custom-product-addons-pro allows Path Traversal.This …

woocommerce_custom_product_addons_pro | Remote | Path Traversal

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

8.8 HIGH

CVE-2026-125449 — WordPress Testimonial Slider plugin <= 3.0.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Testimonial Slider testimonial-slider-and-showcase allows Object Injection.This issue affects Testimonial Slider: from n/a through 3.…

Remote | Injection

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

6.5 MEDIUM

CVE-2026-124755 — WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.4 - Cross Site Scripti…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit Advanced Custom Fields: Font Awesome Field advanced-custom-fields-font-awesome allow…

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

9.8 CRITICAL

CVE-2026-125769 — WordPress Advanced Form Integration plugin <= 2.11.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows Privilege Escalation.This issue affects Advanced Form Integration: from n/a thro…

advanced_form_integration | Remote | Authorization

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125764 — WordPress e2pdf plugin <= 1.32.65 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.65.

e2pdf | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-124259 — WordPress Events Made Easy plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franky Events Made Easy events-made-easy allows Reflected XSS.This issue affects Events Made Easy…

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

6.5 MEDIUM

CVE-2026-125805 — WordPress GeoDirectory plugin <= 2.8.204 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory allows Stored XSS.This issue affects GeoDirectory: from n/a…

geodirectory | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125828 — WordPress BookIt plugin <= 2.6.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP BookIt bookit allows Stored XSS.This issue affects BookIt: from n/a throug…

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125791 — WordPress Orphans plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iWorks Orphans sierotki allows Stored XSS.This issue affects Orphans: from n/a through 3.4.6.

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

8.5 HIGH

CVE-2026-125832 — WordPress WP Data Access plugin <= 5.5.92 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows SQL Injection.This issue affects…

wp_data_access | Remote | Injection

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-124254 — WordPress EWWW Image Optimizer plugin <= 8.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exactly WWW LLC EWWW Image Optimizer ewww-image-optimizer allows Stored XSS.This issue affects EW…

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125813 — WordPress Survey Maker plugin <= 5.2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Reflected XSS.This issue affects Survey Maker: from n/a …

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125443 — WordPress WPJAM Basic plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows DOM-Based XSS.This issue affects WPJAM Basic: from n/a th…

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-124995 — WordPress Track, Analyze & Optimize by WP Tao plugin <= 1.3.1 - Cross Site Scripting (XSS…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski Track, Analyze & Optimize by WP Tao wp-tao allows Stored XSS.This issue affects T…

track_analyze_optimize_by_wp_tao | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-124270 — WordPress NEX-Forms plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-For…

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125789 — WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.20 - Cross Site Scripting (…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Stored XSS.This issue affects Vi…

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125790 — WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.20 - Cross Site Scripting (…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Stored XSS.This issue affects Vi…

Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

9.8 CRITICAL

CVE-2026-122662 — WordPress Document Library Pro plugin < 4.2.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Barn2 Plugins Document Library Pro document-library-pro allows Object Injection.This issue affects Document Library Pro: from n/a before 4.2.2.

Remote | Injection

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

6.5 MEDIUM

CVE-2026-125857 — WordPress Dynamic User Directory plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Stored XSS.This issue affects Dy…

dynamic_user_directory | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

7.1 HIGH

CVE-2026-125775 — WordPress CRM Perks Forms plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms crm-perks-forms allows Reflected XSS.This issue affects CRM Perks Forms…

crm_perks_forms | Remote | Cross-Site Scripting

Nov 15, 2026 Nov 15, 2026

Nov 15, 2026

Browse by Apps

Latest CVE Feed

Cookie Preferences