Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-6251 — Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_field() function in admin/class…

Remote | Injection
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
4.9 MEDIUM
CVE-2026-16811 — ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and includi…

Remote | Injection
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
4.3 MEDIUM
CVE-2026-16797 — ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Se…

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'o…

Remote | Authorization
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
4.3 MEDIUM
CVE-2026-16587 — Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+)…

The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not proper…

Remote | Authorization
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
7.2 HIGH
CVE-2026-16585 — Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via P…

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_stic…

Remote | Path Traversal
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
4.3 MEDIUM
CVE-2026-15136 — Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery…

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorre…

Remote | Cross-Site Request Forgery
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
5.3 MEDIUM
CVE-2026-15012 — Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handle_restore_step fun…

Remote | Path Traversal
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-14926 — FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any au…

| Authorization
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-14924 — Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification

The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published…

| Authentication
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-14870 — Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Refl…

| Cross-Site Scripting
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-14821 — Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete…

| Authorization
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-14819 — Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above t…

| Cross-Site Scripting
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-14545 — TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Re…

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to…

| Authentication
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
7.5 HIGH
CVE-2026-14490 — Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX a…

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists b…

Remote | Path Traversal
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
5.3 MEDIUM
CVE-2026-12124 — PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via…

The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability …

Remote | Authorization
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-15730 — GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'head…

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribut…

| Cross-Site Scripting
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-15673 — SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_p…

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkout_payment_plans' and 'order_status' Se…

| Injection
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-15670 — SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up …

| Injection
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-15671 — SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and …

| Injection
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-15014 — SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billi…

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to,…

| Authentication
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Showing 20 of 9342 Results