CVE-2026-4889
— SQL Injection (SQLi) in eLoanApp Platform by RDL Technologies
SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to bo…
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-48199
— WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
Remote
|
Authorization
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-48197
— WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a t…
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42638
— WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digi…
Oct 06, 2026
Oct 07, 2026
Oct 06, 2026
Oct 07, 2026
CVE-2026-42637
— WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerabil…
Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
Remote
|
Authentication
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42636
— WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site…
Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42635
— WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulne…
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42634
— WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.…
Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42418
— WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: f…
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 07, 2026
Oct 06, 2026
Oct 07, 2026
CVE-2026-42417
— WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42416
— WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability
Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42415
— WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42414
— WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability
Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-42413
— WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive…
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.
Remote
|
Information Disclosure
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41562
— WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.
Remote
|
Information Disclosure
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41561
— WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.
Remote
|
Information Disclosure
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41560
— WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.
Remote
|
Authorization
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41559
— WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data…
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions.
Remote
|
Information Disclosure
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-41555
— WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <=…
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.
Remote
|
Injection
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
CVE-2026-40807
— WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cros…
Unauthenticated Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.6 versions.
Remote
|
Cross-Site Scripting
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
