Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-40808 — WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.7 HIGH
CVE-2026-40805 — WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

peepso | Remote | Path Traversal
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-40803 — WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.6 HIGH
CVE-2026-40802 — WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability

Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-40801 — WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability

Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

wordable | Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.3 CRITICAL
CVE-2026-40800 — WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5…

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

Remote | Injection
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-40777 — WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.1 HIGH
CVE-2026-39802 — WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

everest_backup | Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
9.8 CRITICAL
CVE-2026-39801 — WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-39800 — WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting …

Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

additional_order_filters_for_woocommerce | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.1 HIGH
CVE-2026-39799 — WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

wp_file_download | Remote | Cross-Site Scripting
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
7.2 HIGH
CVE-2026-27350 — WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

builderius | Remote | Server-Side Request Forgery
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
6.3 MEDIUM
CVE-2026-108604 — Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification

Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by sub…

| Authorization
Oct 10, 2026 Oct 16, 2026
Oct 10, 2026
Oct 16, 2026
4.8 MEDIUM
CVE-2026-108603 — slide-maker through 5.8.0 Path Traversal via generate_images_openai.py

slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames.…

| Path Traversal
Oct 10, 2026 Oct 16, 2026
Oct 10, 2026
Oct 16, 2026
5.3 MEDIUM
CVE-2026-108602 — Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnam…

Remote | Server-Side Request Forgery
Oct 10, 2026 Oct 18, 2026
Oct 10, 2026
Oct 18, 2026
5.4 MEDIUM
CVE-2026-107434 — WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability

Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.

micropayments | Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
5.3 MEDIUM
CVE-2026-107420 — WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.…

Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.

Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
4.3 MEDIUM
CVE-2026-103685 — WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2…

Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Le…

Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
8.2 HIGH
CVE-2026-96341 — WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

forminator | Remote | Authorization
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
6.5 MEDIUM
CVE-2026-94590 — WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability

Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: fro…

Remote | Authentication
Oct 10, 2026 Oct 13, 2026
Oct 10, 2026
Oct 13, 2026
Showing 20 of 16258 Results