Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
49165
Total
3939
Critical
14577
High
14341
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-17019 | MEDIUM | 6.1 | The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload … | Aug 10, 2026 |
| CVE-2026-17018 | UNKNOWN | — | The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one … | Aug 10, 2026 |
| CVE-2026-17016 | UNKNOWN | — | The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in … | Aug 10, 2026 |
| CVE-2026-17012 | UNKNOWN | — | The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches … | Aug 10, 2026 |
| CVE-2026-17010 | MEDIUM | 5.4 | The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access … | Aug 10, 2026 |
| CVE-2026-16985 | UNKNOWN | — | The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update … | Aug 10, 2026 |
| CVE-2026-16949 | UNKNOWN | — | The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers … | Aug 10, 2026 |
| CVE-2026-16299 | UNKNOWN | — | The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password … | Aug 10, 2026 |
| CVE-2026-16298 | UNKNOWN | — | The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including … | Aug 10, 2026 |
| CVE-2026-16257 | UNKNOWN | — | The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of its REST endpoints, whose only access control can … | Aug 10, 2026 |
| CVE-2026-15238 | UNKNOWN | — | The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account … | Aug 10, 2026 |
| CVE-2026-15237 | UNKNOWN | — | The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing … | Aug 10, 2026 |
| CVE-2026-15229 | UNKNOWN | — | The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at … | Aug 10, 2026 |
| CVE-2026-15047 | UNKNOWN | — | The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access … | Aug 10, 2026 |
| CVE-2026-14941 | UNKNOWN | — | The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allowing users with minimal … | Aug 10, 2026 |
| CVE-2026-14860 | UNKNOWN | — | The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side request built from user-supplied input, allowing unauthenticated attackers to make … | Aug 10, 2026 |
| CVE-2026-14293 | UNKNOWN | — | The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does … | Aug 10, 2026 |
| CVE-2026-14238 | UNKNOWN | — | The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database … | Aug 10, 2026 |
| CVE-2026-14237 | UNKNOWN | — | The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant … | Aug 10, 2026 |
| CVE-2026-14211 | UNKNOWN | — | The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the customer whose … | Aug 10, 2026 |
| CVE-2026-14206 | HIGH | 7.5 | The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated … | Aug 10, 2026 |
| CVE-2026-13701 | MEDIUM | 4.8 | The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the … | Aug 10, 2026 |
| CVE-2026-13600 | UNKNOWN | — | The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled … | Aug 10, 2026 |
| CVE-2026-13170 | UNKNOWN | — | The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with … | Aug 10, 2026 |
| CVE-2026-13133 | UNKNOWN | — | A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure … | Aug 10, 2026 |