Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50169
Total
4054
Critical
14909
High
14667
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-15950 | MEDIUM | 6.4 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored … | Aug 01, 2026 |
| CVE-2026-15662 | MEDIUM | 6.4 | The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color' parameter in … | Aug 01, 2026 |
| CVE-2026-15649 | MEDIUM | 6.4 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and … | Aug 01, 2026 |
| CVE-2026-15645 | MEDIUM | 6.4 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all versions up to, … | Aug 01, 2026 |
| CVE-2026-15644 | MEDIUM | 6.4 | The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, … | Aug 01, 2026 |
| CVE-2026-15601 | MEDIUM | 4.9 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, … | Aug 01, 2026 |
| CVE-2026-15450 | HIGH | 8.1 | The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, … | Aug 01, 2026 |
| CVE-2026-15052 | HIGH | 7.2 | The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all … | Aug 01, 2026 |
| CVE-2026-15018 | MEDIUM | 5.3 | The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to, and including, 1.2.10 … | Aug 01, 2026 |
| CVE-2026-13458 | MEDIUM | 6.4 | The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, … | Aug 01, 2026 |
| CVE-2026-11995 | MEDIUM | 5.3 | The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in … | Aug 01, 2026 |
| CVE-2026-10782 | MEDIUM | 4.3 | The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin … | Aug 01, 2026 |
| CVE-2025-14073 | MEDIUM | 5.3 | The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, … | Aug 01, 2026 |
| CVE-2026-2916 | MEDIUM | 4.3 | The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` … | Aug 01, 2026 |
| CVE-2026-15988 | HIGH | 8.8 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up … | Aug 01, 2026 |
| CVE-2025-14469 | MEDIUM | 4.3 | The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing … | Aug 01, 2026 |
| CVE-2026-15932 | UNKNOWN | — | The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with … | Aug 01, 2026 |
| CVE-2026-15368 | UNKNOWN | — | The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing … | Aug 01, 2026 |
| CVE-2026-15262 | UNKNOWN | — | The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table … | Aug 01, 2026 |
| CVE-2026-15244 | UNKNOWN | — | The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing … | Aug 01, 2026 |
| CVE-2026-15234 | UNKNOWN | — | The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when … | Aug 01, 2026 |
| CVE-2026-14840 | UNKNOWN | — | The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP … | Aug 01, 2026 |
| CVE-2026-14839 | UNKNOWN | — | The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to … | Aug 01, 2026 |
| CVE-2026-14836 | UNKNOWN | — | The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification … | Aug 01, 2026 |
| CVE-2026-14823 | UNKNOWN | — | The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access … | Aug 01, 2026 |