Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.1 HIGH
CVE-2026-39784 — WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

hotel_booking | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39781 — WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document G…

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 15, 2026
Oct 06, 2026
Oct 15, 2026
7.1 HIGH
CVE-2026-39780 — WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39778 — WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2…

Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.0 HIGH
CVE-2026-39776 — WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.8 HIGH
CVE-2026-39775 — WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulner…

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.8 HIGH
CVE-2026-39774 — WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
10.0 CRITICAL
CVE-2026-39773 — WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.3 MEDIUM
CVE-2026-39772 — WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-39771 — WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
10.0 CRITICAL
CVE-2026-39770 — WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-39769 — WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Password Recovery Explo…

Remote | Authentication
Oct 06, 2026 Oct 23, 2026
Oct 06, 2026
Oct 23, 2026
6.5 MEDIUM
CVE-2026-39767 — WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability

Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.

Remote | Denial of Service
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39766 — WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

arforms | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.2 HIGH
CVE-2026-39765 — WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-39764 — WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 …

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-39762 — WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken …

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Level…

autoship_cloud_for_woocommerce | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.8 CRITICAL
CVE-2026-39761 — WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.9 CRITICAL
CVE-2026-39759 — WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability

Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.

Remote | Misconfiguration
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-39758 — WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16657 Results