VulnSea

Tagged “nvd”

CVEs tagged nvd, newest first.

51020 CVEsRSS

CVE-2026-62051Critical· 9.8
1mo ago

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

▾ MidnightThemeREX · StargazeEPSS 0.38%via NVD
CVE-2026-62050Critical· 9.8
1mo ago

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

▾ MidnightThemeREX · SplendourEPSS 0.38%via NVD
CVE-2026-62043High· 7.5
1mo ago

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

▾ Twilightsevenspark · contact-form-7-dynamic-text-extensionEPSS 0.30%via NVD
CVE-2026-62038High· 7.3
1mo ago

Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

▾ TwilightDigitalME · eroom-zoom-meetings-webinarEPSS 0.27%via NVD
CVE-2026-62037High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

▾ TwilightbPlugins · document-emberdderEPSS 0.18%via NVD
CVE-2026-62035Medium· 6.3
1mo ago

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

▾ Sunlitupcasted · upcasted-s3-offloadEPSS 0.25%via NVD
CVE-2026-62034High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

▾ TwilightbPlugins · before-after-image-compareEPSS 0.18%via NVD
CVE-2026-62033High· 7.6
1mo ago

Subscriber Settings Change in uListing <= 2.2.0 versions.

Subscriber Settings Change in uListing <= 2.2.0 versions.

▾ TwilightStylemix · ulistingEPSS 0.30%via NVD
CVE-2026-62032Critical· 9.8
1mo ago

Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

▾ MidnightDesigninvento · directorypressEPSS 0.40%via NVD
CVE-2026-62031Critical· 9.3
1mo ago

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

▾ MidnightStylemix · ulistingEPSS 0.28%via NVD
CVE-2026-62030High· 7.2
1mo ago

Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

▾ TwilightbPlugins · streamcastEPSS 0.19%via NVD
CVE-2026-62027High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

▾ TwilightbPlugins · team-sectionEPSS 0.18%via NVD
CVE-2026-62025Critical· 9.0
1mo ago

Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.

Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.

▾ MidnightTailored Media · tailored-toolsEPSS 0.29%via NVD
CVE-2026-62024Critical· 9.9
1mo ago

Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

▾ MidnightCodeBard · codebard-help-deskEPSS 0.43%via NVD
CVE-2026-62022Critical· 9.8
1mo ago

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

▾ MidnightSelect-Themes · Tonda MembershipEPSS 0.32%via NVD
CVE-2026-62021High· 8.8
1mo ago

Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

▾ Twilightrascals · AngioEPSS 0.47%via NVD
CVE-2026-62020High· 8.1
1mo ago

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

▾ TwilightMikado-Themes · TouchUpEPSS 0.34%via NVD
CVE-2026-57742High· 7.1
1mo ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

▾ TwilightThemeREX Group · Kids PlanetEPSS 0.14%via NVD
CVE-2026-48194High· 8.1
1mo ago

Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

▾ Twilightkutethemes · DukaMarketEPSS 0.34%via NVD
CVE-2026-48193High· 8.1
1mo ago

Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

▾ Twilightkutethemes · UminexEPSS 0.34%via NVD
CVE-2026-45440High· 7.6
1mo ago

Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

▾ TwilightSmackcoders Inc. · wp-ultimate-csv-importerEPSS 0.28%via NVD
CVE-2026-42777High· 8.1
1mo ago

Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

▾ TwilightEdge-Themes · AaltoEPSS 0.34%via NVD
CVE-2026-42724High· 8.1
1mo ago

Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

▾ TwilightAncoraThemes · CleanSkinEPSS 0.34%via NVD
CVE-2026-42723Critical· 9.8
1mo ago

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

▾ MidnightAncoraThemes · CleanSkinEPSS 0.38%via NVD
CVE-2026-42722High· 7.6
1mo ago

Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

▾ TwilightShabti Kaplan · acf-frontend-form-elementEPSS 0.28%via NVD
CVE-2026-42719Critical· 9.8
1mo ago

Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

▾ MidnightSarah Giles · dynamic-user-directoryEPSS 0.51%via NVD
CVE-2026-42718Critical· 9.8
1mo ago

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

▾ MidnightPluggabl · woocommerce-jetpackEPSS 0.38%via NVD
CVE-2026-42717High· 7.6
1mo ago

Administrator SQL Injection in Leyka <= 3.32.3 versions.

Administrator SQL Injection in Leyka <= 3.32.3 versions.

▾ TwilightVaultDweller · leykaEPSS 0.28%via NVD
CVE-2026-42716Critical· 9.8
1mo ago

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

▾ Midnightpayever · payever-woocommerce-gatewayEPSS 0.38%via NVD
CVE-2026-42715High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

▾ Twilight10Web · photo-galleryEPSS 0.18%via NVD
CVEs tagged “nvd” — page 166 · VulnSea