Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.1 HIGH
CVE-2026-42418 — WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: f…

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 07, 2026
Oct 06, 2026
Oct 07, 2026
9.3 CRITICAL
CVE-2026-42417 — WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability

Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-42416 — WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability

Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-42415 — WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-42414 — WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

listingpro | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-42413 — WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive…

Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-41562 — WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-41561 — WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-41560 — WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-41559 — WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data…

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup &amp; Restore <= 2.1.2 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-41555 — WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <=…

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-40807 — WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cros…

Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-40806 — WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scri…

Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39798 — WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.

truebooker | Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.8 CRITICAL
CVE-2026-39797 — WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-39796 — WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access …

Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-39795 — WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability

Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.

sendpress | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-39794 — WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access …

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.8 HIGH
CVE-2026-39793 — WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.6 HIGH
CVE-2026-39792 — WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

simple_file_list | Remote | Path Traversal
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16230 Results