Tagged “cve.org”
CVEs tagged cve.org, newest first.
46567 CVEsRSS
CVE-2026-119526Critical· 9.8WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
CVE-2026-39786High· 7.1WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
CVE-2026-27061Medium· 6.5WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
CVE-2026-54854Medium· 6.3WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability
Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.
CVE-2026-39734High· 7.5WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability
Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
CVE-2026-90888Critical· 9.8WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
CVE-2026-54850Medium· 6.5WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.
CVE-2026-73186High· 8.8WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
CVE-2026-94175High· 7.1WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
CVE-2026-105077High· 7.1WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.
CVE-2026-7003Medium· 5.3PoCWIT SynApps Runtime 1.4.11 Hardcoded OAuth Credentials Disclosure
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in…
CVE-2026-62303Medium· 5.9Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes.…
CVE-2026-116851High· 7.1WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.
CVE-2026-115604Medium· 5.0WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability
Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.
CVE-2026-116386Critical· 9.8WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
CVE-2026-114711Medium· 6.5WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.
CVE-2026-116405High· 7.1WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.
CVE-2026-115947Medium· 6.5WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
CVE-2026-116847High· 7.1WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.
CVE-2026-116861High· 7.5WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
CVE-2026-116410Medium· 6.5WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.
CVE-2026-118090High· 8.8WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
CVE-2026-116853Medium· 6.5WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
CVE-2026-116862High· 7.5WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.
CVE-2026-116854Medium· 6.5WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
CVE-2026-118089High· 7.2WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
CVE-2026-62122Medium· 5.3WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
CVE-2026-62047Medium· 4.3WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
CVE-2026-104674Medium· 4.3WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
CVE-2026-62121Medium· 6.5WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-element…