CVE-2026-40803: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Jotform – AI Chatbot = 3.8.2 versions...

CVE-2026-108554: Server-Side Request Forgery (SSRF)

PDFMathTranslate pdf2zh through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translatefile handler passes user URLs to downloadwithlimit without scheme or address validation, letti...

CVE-2026-103635: Out-of-bounds Read

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ repo: datasketches-cpp. compactthetasketch::deserialize and wrappedcompactthetasketch::wrap read header fields before checking that the input was long enough. For the compressed format, the size check could ...

CVE-2026-108505: Improper Privilege Management

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information...

CVE-2026-12626: Deserialization of Untrusted Data

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-lev...

CVE-2026-104723: Deserialization of Untrusted Data

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

CVE-2026-104752: Unrestricted Upload of File with Dangerous Type

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...

CVE-2026-106139: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo UI for Vue @progress/kendo-vue-charts starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a...

CVE-2026-104898: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-104766: Improper Privilege Management

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the OsSettingsController::update handler iterating over attacker-supplied settings parameters...

CVE-2026-103889: Unrestricted Upload of File with Dangerous Type

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpvimage' parameter parameter. This is due to missing authentication and nonce checks on the wploaded handler combined with no sanitization...

CVE-2026-104915: Missing Authorization

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo...

CVE-2026-105892: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13...

CVE-2026-104021: Improper Control of Generation of Code

The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.7.4 via the fastcachesettingscachecookieexclude parameter. This is due to the plugin registering the cachecookieexclude setting via registersetting without a sanitizecallback, whi...

CVE-2026-107645: Improper Privilege Management

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implementuserregistration AJAX handler explicitly disabling Dokan's vendor-registration nonce check via addfilter'dokanregisternoncecheck', 'returnfalse' an...

CVE-2026-107321: Improper Limitation of a Pathname to a Restricted Directory

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary...

CVE-2026-106606: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0...

CVE-2026-102774: Improper Neutralization of Input During Web Page Generation

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-12054: Improper Neutralization of Input During Web Page Generation

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-97264: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4...

CVE-2026-102388: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3...

CVE-2026-103897: Improper Neutralization of Input During Web Page Generation

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-107742: Improper Neutralization of Input During Web Page Generation

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-97396: Improper Neutralization of Input During Web Page Generation

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-78068: Improper Neutralization of Input During Web Page Generation

The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-107712: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'currentmonth' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-62022: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Tonda Membership = 1.0.1 versions...

CVE-2026-42631: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Qode Music = 2.1.8.2 versions...

CVE-2026-48194: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in DukaMarket = 1.3.0 versions...

CVE-2026-40800: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes = 1.5.3 versions...

CVE-2026-39801: Incorrect Privilege Assignment

Subscriber Privilege Escalation in AIWU = 1.5.9 versions...

CVE-2026-39800: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Additional Order Filters for WooCommerce = 1.24 versions...

CVE-2026-42633: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Events Manager = 7.4.6 versions...

CVE-2026-42715: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Photo Gallery by 10Web = 1.8.47 versions...

CVE-2026-42718: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booster for WooCommerce = 8.4.0 versions...

CVE-2026-42723: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in CleanSkin = 1.5.0 versions...

CVE-2026-42724: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in CleanSkin = 1.5.0 versions...

CVE-2026-42696: Improper Control of Generation of Code

Unauthenticated Remote Code Execution RCE in SiteVault – Backup, Restore, Migration & Cloning = 1.5.19 versions...

CVE-2026-42702: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0...

CVE-2026-42777: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Aalto = 1.8 versions...

CVE-2026-42712: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Qode Tours = 3.1.3.2 versions...

CVE-2026-91862: Improper Neutralization of Input During Web Page Generation

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-96572: Improper Neutralization of Input During Web Page Generation

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-94590: Improper Verification of Source of a Communication Channel

Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3...

CVE-2026-93951: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0...

CVE-2026-93943: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0...

CVE-2026-93930: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0...

CVE-2026-104754: Improper Neutralization of Input During Web Page Generation

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections Administrators by default to store JavaScript that executes in the session of any user who later open...

CVE-2026-100196: Improper Neutralization of Input During Web Page Generation

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentcontent rendered inline into the page HTML' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escapin...

CVE-2026-103424: Improper Neutralization of Input During Web Page Generation

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 6.88 due to insufficient input sanitization and output escaping. This makes it possible for...