VulnSea

Tagged “nvd”

CVEs tagged nvd, newest first.

51020 CVEsRSS

CVE-2026-94121High· 8.8
1mo ago

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

▾ Twilight10Web · tenweb-speed-optimizerEPSS 0.37%via NVD
CVE-2026-94120High· 7.5
1mo ago

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

▾ TwilightGravityKit · gf-entries-in-excelEPSS 0.28%via NVD
CVE-2026-94178High· 7.5
1mo ago

Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.

Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.

▾ TwilightJavier Carazo · import-users-from-csv-with-metaEPSS 0.29%via NVD
CVE-2026-94123High· 7.5
1mo ago

Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

▾ TwilightSyed Balkhi · nextgen-galleryEPSS 0.39%via NVD
CVE-2026-94122High· 7.2
1mo ago

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

▾ TwilightA WP Life · responsive-slider-galleryEPSS 0.36%via NVD
CVE-2026-94499High· 7.1
1mo ago

Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

▾ TwilightwpWax · formgentEPSS 0.28%via NVD
CVE-2026-94389Critical· 9.0
1mo ago

Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.

▾ MidnightAcyMailing Newsletter Team · acymailingEPSS 0.45%via NVD
CVE-2026-94177High· 8.5
1mo ago

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.

▾ TwilightRuben Garcia · gamipressEPSS 0.25%via NVD
CVE-2026-94678High· 8.8
1mo ago

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

▾ TwilightMat Lipe · go-live-update-urlsEPSS 0.37%via NVD
CVE-2026-94673Medium· 5.3
1mo ago

Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.

▾ SunlitNSquared · simply-schedule-appointmentsEPSS 0.24%via NVD
CVE-2026-94672Medium· 4.3
1mo ago

Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

▾ Sunlit10up · safe-svgEPSS 0.21%via NVD
CVE-2026-94681Medium· 5.9
1mo ago

Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.

Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.

▾ SunlitTijmen Smit · wp-store-locatorEPSS 0.29%via NVD
CVE-2026-94677High· 7.2
1mo ago

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

▾ TwilightNexcess · kadence-woocommerce-email-designerEPSS 0.39%via NVD
CVE-2026-94674Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

▾ SunlitSweetCode · woocommerce-google-adwords-conversion-tracking-tagEPSS 0.16%via NVD
CVE-2026-96346High· 7.6
1mo ago

Author SQL Injection in WP ERP <= 1.17.9 versions.

Author SQL Injection in WP ERP <= 1.17.9 versions.

▾ TwilightweDevs · erpEPSS 0.27%via NVD
CVE-2026-95531High· 8.8
1mo ago

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

▾ TwilightQuantumCloud · conversational-formsEPSS 0.47%via NVD
CVE-2026-94683High· 8.8
1mo ago

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

▾ TwilightJustin Nealey · designsetgoEPSS 0.34%via NVD
CVE-2026-96347Medium· 6.5
1mo ago

Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.

Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.

▾ SunlitBookly · bookly-responsive-appointment-booking-toolEPSS 0.27%via NVD
CVE-2026-96344High· 7.2
1mo ago

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

▾ TwilightimpleCode · ecommerce-product-catalogEPSS 0.36%via NVD
CVE-2026-96338Medium· 6.5
1mo ago

Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.

Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.

▾ SunlitCozmoslabs · profile-builderEPSS 0.21%via NVD
CVE-2026-96348High· 7.5
1mo ago

Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

▾ TwilightBookly · bookly-responsive-appointment-booking-toolEPSS 0.26%via NVD
CVE-2026-96345High· 7.6
1mo ago

Administrator SQL Injection in Estatik <= 4.3.5 versions.

Administrator SQL Injection in Estatik <= 4.3.5 versions.

▾ TwilightEstatik · estatikEPSS 0.27%via NVD
CVE-2026-96343High· 7.2
1mo ago

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

▾ TwilightweDevs · erpEPSS 0.36%via NVD
CVE-2026-96351High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

▾ TwilightRadiusTheme · classified-listingEPSS 0.18%via NVD
CVE-2026-96350Critical· 9.8
1mo ago

Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.

Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.

▾ MidnightEstatik · estatikEPSS 0.44%via NVD
CVE-2026-96349Critical· 10.0PoC
1mo ago

Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.

Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.

▾ AbyssalSiteSkite · siteskiteEPSS 0.73%via NVD
CVE-2026-96815High· 7.2
1mo ago

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

▾ Twilightappsbd · vitepos-liteEPSS 0.31%via NVD
CVE-2026-96814High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

▾ TwilightWP Titan Labs · wc-product-table-liteEPSS 0.18%via NVD
CVE-2026-96352High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

▾ TwilightYITHEMES · yith-woocommerce-ajax-searchEPSS 0.18%via NVD
CVE-2026-96825Medium· 4.2
1mo ago

Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.

▾ SunlitDavid Anderson / Team Updraft · all-in-one-wp-security-and-firewallEPSS 0.19%via NVD
CVEs tagged “nvd” — page 307 · VulnSea