Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-17580 — Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive …

The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Informatio…

Remote | Information Disclosure
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.1 MEDIUM
CVE-2026-17571 — Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and …

Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
4.9 MEDIUM
CVE-2026-17555 — WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Param…

The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. This is due to insufficient escaping on the…

migration\,_backup\,_staging | Remote | Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-16685 — Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via…

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and including, 3.3.66 due to insufficient input sanitizati…

download_manager | Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-16684 — Easy Property Listings <= 3.5.24 - Authenticated (Subscriber+) Stored Cross-Site Scriptin…

The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input …

easy_property_listings | Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.8 HIGH
CVE-2026-16635 — Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity For…

The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_update_user_role()` function passing an attacker-con…

Remote | Authorization
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
4.9 MEDIUM
CVE-2026-16614 — GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter

The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 5.2.1 due…

Remote | Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.1 HIGH
CVE-2026-16144 — Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Pa…

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due…

contact_form_builder | Remote | Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-16091 — GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gami…

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipress_rank' Shortcode in…

gamipress | Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-16090 — GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamip…

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribut…

gamipress | Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.5 MEDIUM
CVE-2026-16087 — Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'm…

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in all versions up to, and including, 3.1.4…

Remote | Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
9.8 CRITICAL
CVE-2026-15964 — Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Pas…

The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and including, 2.0.0. This is due to the `ssoprocess_a…

Remote | Authentication
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
4.9 MEDIUM
CVE-2026-15951 — Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Para…

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied p…

Remote | Injection
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-15950 — Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lay…

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'layoutCircle.alignment' Bloc…

Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-15662 — Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting vi…

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' parameter in all versions up to, and including, …

Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-15649 — Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcod…

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficie…

powerkit | Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-15645 — Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Sh…

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insuf…

powerkit | Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
6.4 MEDIUM
CVE-2026-15644 — Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' …

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to ins…

powerkit | Remote | Cross-Site Scripting
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
4.9 MEDIUM
CVE-2026-15601 — Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Sli…

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via the extract_zip_file f…

Remote | Path Traversal
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
8.1 HIGH
CVE-2026-15450 — NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal v…

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the delete_file()…

nex-forms | Remote | Path Traversal
Aug 01, 2026 Aug 01, 2026
Aug 01, 2026
Aug 01, 2026
Showing 20 of 9308 Results