Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-95523 — WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

wp_user_frontend | Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.6 HIGH
CVE-2026-95522 — WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability

Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.

easy_digital_downloads | Remote | Injection
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.1 HIGH
CVE-2026-95515 — WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

ninja_forms | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
5.3 MEDIUM
CVE-2026-95514 — WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

netgsm | Remote | Authentication
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.5 HIGH
CVE-2026-95513 — WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - B…

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

online_booking_\&_scheduling_calendar | Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94684 — WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions.

ocean_extra | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94682 — WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulner…

Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

podcast_importer_secondline | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94680 — WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

the_post_grid | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
5.4 MEDIUM
CVE-2026-94679 — WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

fluent_support | Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94671 — WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

the_post_grid | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94500 — WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) …

Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.

elements_kit_elementor_addons | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94498 — WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

appmysite | Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
8.1 HIGH
CVE-2026-94487 — WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) …

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

capabilities | Remote | Cross-Site Request Forgery
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94461 — WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

ditty | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
4.8 MEDIUM
CVE-2026-94457 — WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

Remote | Authentication
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94391 — WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.4 HIGH
CVE-2026-94181 — Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullsc…

Remote | Misconfiguration
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.1 HIGH
CVE-2026-94179 — WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerabil…

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.1 HIGH
CVE-2026-94176 — WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.6 HIGH
CVE-2026-94174 — WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability

Administrator SQL Injection in Email Log <= 2.63 versions.

Remote | Injection
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Showing 20 of 14366 Results