Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-15382 | MEDIUM | 6.5 | The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon … | Jul 30, 2026 |
| CVE-2026-15257 | MEDIUM | 5.3 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other … | Jul 30, 2026 |
| CVE-2026-15255 | MEDIUM | 5.3 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before … | Jul 30, 2026 |
| CVE-2026-15252 | MEDIUM | 5.4 | The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated … | Jul 30, 2026 |
| CVE-2026-15250 | MEDIUM | 5.3 | The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing … | Jul 30, 2026 |
| CVE-2026-15240 | HIGH | 7.5 | The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account … | Jul 30, 2026 |
| CVE-2026-15235 | MEDIUM | 4.3 | The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its … | Jul 30, 2026 |
| CVE-2026-15153 | MEDIUM | 6.8 | The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a … | Jul 30, 2026 |
| CVE-2026-15054 | LOW | 3.7 | The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries … | Jul 30, 2026 |
| CVE-2026-14923 | MEDIUM | 6.5 | The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates … | Jul 30, 2026 |
| CVE-2026-14602 | CRITICAL | 9.0 | The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which … | Jul 30, 2026 |
| CVE-2026-14592 | MEDIUM | 6.1 | The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, … | Jul 30, 2026 |
| CVE-2026-14318 | MEDIUM | 6.8 | The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP … | Jul 30, 2026 |
| CVE-2026-14310 | MEDIUM | 5.4 | The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before … | Jul 30, 2026 |
| CVE-2026-14305 | MEDIUM | 5.3 | The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited … | Jul 30, 2026 |
| CVE-2026-14239 | UNKNOWN | — | The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not … | Jul 30, 2026 |
| CVE-2026-14231 | MEDIUM | 4.3 | The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user … | Jul 30, 2026 |
| CVE-2026-14226 | MEDIUM | 4.3 | The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a … | Jul 30, 2026 |
| CVE-2026-14223 | MEDIUM | 4.3 | The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read … | Jul 30, 2026 |
| CVE-2026-14222 | LOW | 3.8 | The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level … | Jul 30, 2026 |
| CVE-2026-14221 | LOW | 3.8 | The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any … | Jul 30, 2026 |
| CVE-2026-14207 | MEDIUM | 6.1 | The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a … | Jul 30, 2026 |
| CVE-2026-14188 | LOW | 2.7 | The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users … | Jul 30, 2026 |
| CVE-2026-13395 | HIGH | 8.6 | The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking … | Jul 30, 2026 |
| CVE-2026-13345 | MEDIUM | 5.3 | The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, … | Jul 30, 2026 |