Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.6 HIGH
CVE-2026-94174 — WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability

Administrator SQL Injection in Email Log <= 2.63 versions.

Remote | Injection
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94168 — WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vu…

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

premium_addons_for_elementor | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
8.5 HIGH
CVE-2026-94124 — WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability

Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.

Remote | Injection
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94118 — WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site S…

Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
5.3 MEDIUM
CVE-2026-94080 — WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.

Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
5.3 MEDIUM
CVE-2026-94079 — WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.

Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.1 HIGH
CVE-2026-93774 — WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerabi…

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
8.5 HIGH
CVE-2026-93773 — WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability

Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.

Remote | Injection
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-93772 — WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
5.3 MEDIUM
CVE-2026-93623 — WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerabil…

Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.

ai_engine | Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.1 HIGH
CVE-2026-93622 — WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-93620 — WordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.

Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-93618 — WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a th…

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-93529 — WordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerabi…

Contributor Broken Access Control in WSP MCP &#8211; AI Agents Connector <= 2.7.0 versions.

Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
8.5 HIGH
CVE-2026-93527 — WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability

Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.

Remote | Injection
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.1 HIGH
CVE-2026-93526 — WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
4.3 MEDIUM
CVE-2026-93513 — WordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR) vulnerabil…

Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.

Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
0.0 NA
CVE-2026-77420 — JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/histor…

| Denial of Service
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
0.0 NA
CVE-2026-77422 — JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-…

| Denial of Service
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
8.5 HIGH
CVE-2026-75131 — NetworkManager-l2tp Privilege Escalation via pppd Username Injection

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root …

| Authentication
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Showing 20 of 14335 Results