Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-94684 — WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions.

ocean_extra | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94682 — WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulner…

Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

podcast_importer_secondline | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94680 — WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

the_post_grid | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
5.4 MEDIUM
CVE-2026-94679 — WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

fluent_support | Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94671 — WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

the_post_grid | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94500 — WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) …

Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.

elements_kit_elementor_addons | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94498 — WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

appmysite | Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
8.1 HIGH
CVE-2026-94487 — WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) …

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

capabilities | Remote | Cross-Site Request Forgery
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94461 — WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

ditty | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
4.8 MEDIUM
CVE-2026-94457 — WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

Remote | Authentication
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94391 — WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.4 HIGH
CVE-2026-94181 — Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullsc…

Remote | Misconfiguration
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.1 HIGH
CVE-2026-94179 — WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerabil…

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.1 HIGH
CVE-2026-94176 — WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.

Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
7.6 HIGH
CVE-2026-94174 — WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability

Administrator SQL Injection in Email Log <= 2.63 versions.

Remote | Injection
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94168 — WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vu…

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

premium_addons_for_elementor | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
8.5 HIGH
CVE-2026-94124 — WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability

Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.

Remote | Injection
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
6.5 MEDIUM
CVE-2026-94118 — WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site S…

Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.

premium_blocks_for_gutenburg | Remote | Cross-Site Scripting
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
5.3 MEDIUM
CVE-2026-94080 — WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.

Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
5.3 MEDIUM
CVE-2026-94079 — WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.

wp_user_manager | Remote | Authorization
Sep 23, 2026 Sep 23, 2026
Sep 23, 2026
Sep 23, 2026
Showing 20 of 14373 Results