CVE-2026-94174
— WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
Administrator SQL Injection in Email Log <= 2.63 versions.
Remote
|
Injection
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94168
— WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vu…
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94124
— WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability
Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.
Remote
|
Injection
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94118
— WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site S…
Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94080
— WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.
Remote
|
Authorization
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-94079
— WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
Remote
|
Authorization
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93774
— WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerabi…
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93773
— WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
Remote
|
Injection
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93772
— WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93623
— WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerabil…
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93622
— WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93620
— WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
Remote
|
Authorization
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93618
— WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS.
This issue affects JetTricks: from n/a th…
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93529
— WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerabi…
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
Remote
|
Authorization
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93527
— WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability
Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
Remote
|
Injection
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93526
— WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Remote
|
Cross-Site Scripting
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-93513
— WordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR) vulnerabil…
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
Remote
|
Authorization
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-77420
— JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/histor…
|
Denial of Service
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-77422
— JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-…
|
Denial of Service
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
CVE-2026-75131
— NetworkManager-l2tp Privilege Escalation via pppd Username Injection
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root …
|
Authentication
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
