Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud fo…

▾ SunlitPatterns In The Cloud · autoship-cloudEPSS 0.32%via NVD

CVE-2026-39761Critical· 9.8

1mo ago

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

▾ TwilightDexignZone · jobzillaEPSS 0.31%via NVD

CVE-2026-39769High· 7.5

1mo ago

Unauthenticated Broken Authentication in Graphina <= 3.1.12 versions.

▾ TwilightIqonic Design · graphina-elementor-charts-and-graphsEPSS 0.49%via NVD

CVE-2026-39768High· 7.1

1mo ago

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive.

▾ TwilightCleanTalk Inc · security-malware-firewallEPSS 0.19%via NVD

CVE-2026-39788Medium· 6.5

1mo ago

Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

▾ SunlitShamim Hasan · front-end-pmEPSS 0.21%via NVD

CVE-2026-39774High· 8.8

1mo ago

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

▾ TwilightTourfic AI Studio · tourfic-proEPSS 0.22%via NVD

CVE-2026-39773Critical· 10.0

1mo ago

Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

▾ MidnightAmentoTech · doctreat_coreEPSS 0.26%via NVD

CVE-2026-39781High· 7.1

1mo ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.

▾ TwilightDan Rossiter · document-galleryEPSS 0.18%via NVD

CVE-2026-39778High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.

▾ Twilightthemeansar · ansar-importEPSS 0.18%via NVD

CVE-2026-39776High· 8.0

1mo ago

Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

▾ Twilightwpshopmart · tabs-responsiveEPSS 0.35%via NVD

CVE-2026-39791Medium· 5.3

1mo ago

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.

▾ SunlitMailjet · mailjet-for-wordpressEPSS 0.24%via NVD

CVE-2026-39787Medium· 6.5

1mo ago

Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

▾ Sunlit10Web · wd-instagram-feedEPSS 0.28%via NVD

CVE-2026-39785Critical· 9.3

1mo ago

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.2…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.2…

▾ MidnightSerhii Pasyuk · grand-mediaEPSS 0.23%via NVD

CVE-2026-39780High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

▾ TwilightYouzify · youzifyEPSS 0.18%via NVD

CVE-2026-39793High· 8.8

1mo ago

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

▾ TwilightNicu Micle · simple-jwt-loginEPSS 0.39%via NVD

CVE-2026-39792High· 8.6

1mo ago

Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

▾ TwilightMitchell Bennis · simple-file-listEPSS 0.34%via NVD

CVE-2026-39790High· 7.1

1mo ago

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.

▾ Twilighte4jvikwp · vikrentcarEPSS 0.23%via NVD

CVE-2026-40806High· 7.1

1mo ago

Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

▾ TwilightPlugin Devs · blog-posts-and-category-for-elementorEPSS 0.18%via NVD

CVE-2026-39797Critical· 9.8

1mo ago

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

▾ MidnightData443 Risk Mitigation, Inc. · gdpr-frameworkEPSS 0.32%via NVD

Tagged “nvd”

Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.

Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.

Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.

Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.

Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud fo…

Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.

Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.

Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

Unauthenticated Broken Authentication in Graphina <= 3.1.12 versions.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority

Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.

Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.

Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.

Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.2…

Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.

Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.

Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.