Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
7.2 HIGH
CVE-2026-104757 — WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vu…

Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.1 HIGH
CVE-2026-104747 — WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104672 — WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104670 — WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

learnpress | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.3 HIGH
CVE-2026-104406 — WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.1 HIGH
CVE-2026-104405 — WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.9 MEDIUM
CVE-2026-104399 — WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104395 — WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-104394 — WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.2 HIGH
CVE-2026-104387 — WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

powerpress_podcasting | Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-104385 — WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

groundhogg | Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.1 HIGH
CVE-2026-103346 — WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerabil…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects…

payment_gateway | Remote | Cross-Site Scripting
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
8.5 HIGH
CVE-2026-102915 — WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in WPO365 <= 44.1 versions.

Remote | Authorization
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-102387 — WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

Remote | Information Disclosure
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.3 MEDIUM
CVE-2026-100518 — WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.

advanced_google_recaptcha | Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.3 CRITICAL
CVE-2026-85153 — Information Disclosure Vulnerability in Schmooze dating mobile Application

This vulnerability exists in the Schmooze app due to the use of hardcoded credentials and cryptographic keys in the client application. An unauthenticated remote attacker could exploit this vulnerabi…

Remote | Cryptography
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105807 — SourceCodester Simple Student Information System searchquery.php sql injection

A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The at…

simple_student_information_system | Remote | Injection
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
5.4 MEDIUM
CVE-2026-105305 — Keycloak-services: keycloak-services: device authorization grant bypasses per-client mini…

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security toke…

single_sign-on build_of_keycloak | Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-94299 — elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Ca…

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers t…

Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
9.8 CRITICAL
CVE-2026-94293 — Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

aas_edge_client | Remote | Authentication
Oct 06, 2026 Oct 06, 2026
Oct 06, 2026
Oct 06, 2026
Showing 20 of 16665 Results