CVE-2026-64806

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter...

CVE-2026-64805

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

CVE-2026-64804

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling...

CVE-2026-64803

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK...

CVE-2026-64802

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

CVE-2026-64800

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...

CVE-2026-65550 WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...

CVE-2026-65540 WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...

CVE-2026-65539 WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Kwayy HTML Sitemap = 4.0 versions...

CVE-2026-65538 WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in Machete = 5.2 versions...

CVE-2026-65537 WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability

Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...

CVE-2026-65536 WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری = 4.4.5 versions...

CVE-2026-65535 WordPress TinyMCE Templates plugin <= 4.8.1 - Sensitive Data Exposure vulnerability

Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...

CVE-2026-65533 WordPress Smart SEO Tool plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

CVE-2026-65534 WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...

CVE-2026-65531 WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Qubely = 1.8.14 versions...

CVE-2026-65532 WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability

Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...

CVE-2026-65530 WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in TemplateSpare = 4.2.2 versions...

CVE-2026-65528 WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

CVE-2026-65529 WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Graphina = 3.1.12 versions...

CVE-2026-65527 WordPress LIQUID SPEECH BALLOON plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in LIQUID SPEECH BALLOON = 1.2.5 versions...

CVE-2026-65525 WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi Framework = 2.2.0 versions...

CVE-2026-65526 WordPress Visualizer plugin <= 4.0.6 - SQL Injection vulnerability

Contributor SQL Injection in Visualizer = 4.0.6 versions...

CVE-2026-65524 WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

Contributor Broken Access Control in Avada Custom Branding = 1.2 versions...

CVE-2026-65521 WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

CVE-2026-65522 WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65518 WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Accept Donations with PayPal & Stripe = 1.5.5 versions...

CVE-2026-65519 WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in Photo Gallery = 2.7.7.29 versions...

CVE-2026-65516 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65512 WordPress WP Activity Log plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in WP Activity Log = 5.6.4 versions...

CVE-2026-65514 WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...

CVE-2026-65511 WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65506 WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.12 versions...

CVE-2026-65510 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65505 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65503 WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

CVE-2026-65500 WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65498 WordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Complianz = 7.5.0 versions...

CVE-2026-65499 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in PeproDev Ultimate Invoice = 2.2.6 versions...

CVE-2026-65497 WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability

Administrator PHP Object Injection in Complianz = 7.5.0 versions...

CVE-2026-65496 WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability

Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...

CVE-2026-65495 WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Dokan Pro = 5.0.3 versions...

CVE-2026-65494 WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability

Subscriber SQL Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65492 WordPress Dokan Pro plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Dokan Pro = 5.0.0 versions...

CVE-2026-65493 WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...

CVE-2026-65491 WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability

Subscriber Broken Access Control in Query Wrangler = 1.5.57 versions...

CVE-2026-65490 WordPress Create by Mediavine plugin <= 2.5.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...

CVE-2026-65489 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor = 1.6.2 versions...

CVE-2026-65488 WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery CSRF in LA-Studio Element Kit for Elementor = 1.6.2 versions...