Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51159
Total
4081
Critical
15166
High
14812
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-63232 | CRITICAL | 9.9 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to … | Jul 29, 2026 |
| CVE-2026-63231 | HIGH | 8.1 | A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to … | Jul 29, 2026 |
| CVE-2026-63230 | CRITICAL | 9.1 | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid … | Jul 29, 2026 |
| CVE-2026-63229 | CRITICAL | 9.1 | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to … | Jul 29, 2026 |
| CVE-2026-63228 | LOW | 2.6 | An unrestricted image upload vulnerability in Koollab LMS allowed an authenticated attacker to upload malicious content disguised as an image file via the feedback mail … | Jul 29, 2026 |
| CVE-2026-63227 | CRITICAL | 9.9 | An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a … | Jul 29, 2026 |
| CVE-2026-14300 | UNKNOWN | — | The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification … | Jul 29, 2026 |
| CVE-2026-14234 | UNKNOWN | — | The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to … | Jul 29, 2026 |
| CVE-2026-14224 | MEDIUM | 5.4 | The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the … | Jul 29, 2026 |
| CVE-2026-13692 | MEDIUM | 5.3 | The PayU CommercePro Plugin WordPress plugin through 3.8.9 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the … | Jul 29, 2026 |
| CVE-2026-13690 | HIGH | 7.4 | The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a … | Jul 29, 2026 |
| CVE-2026-13605 | MEDIUM | 6.8 | The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM … | Jul 29, 2026 |
| CVE-2026-13423 | CRITICAL | 9.8 | The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied … | Jul 29, 2026 |
| CVE-2026-11974 | HIGH | 8.6 | The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available … | Jul 29, 2026 |
| CVE-2026-11351 | MEDIUM | 5.3 | The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenticated users to retrieve … | Jul 29, 2026 |
| CVE-2026-18072 | CRITICAL | 9.8 | The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in … | Jul 29, 2026 |
| CVE-2026-5626 | MEDIUM | 4.3 | The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in … | Jul 29, 2026 |
| CVE-2026-15344 | MEDIUM | 4.9 | The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, … | Jul 29, 2026 |
| CVE-2026-12476 | HIGH | 7.2 | The Easy Digital Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 3.6.9. This is due to insufficient … | Jul 29, 2026 |
| CVE-2026-17166 | MEDIUM | 4.3 | The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all … | Jul 29, 2026 |
| CVE-2026-17162 | MEDIUM | 6.4 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all … | Jul 29, 2026 |
| CVE-2026-17161 | MEDIUM | 6.4 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all … | Jul 29, 2026 |
| CVE-2026-15735 | MEDIUM | 6.4 | The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapi_form_field' Post Meta in all versions up to, and … | Jul 29, 2026 |
| CVE-2026-12939 | MEDIUM | 6.4 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the post_thumbnail (and newsletters_post_thumbnail) shortcodes in versions up … | Jul 29, 2026 |
| CVE-2026-12938 | MEDIUM | 6.4 | The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the [newsletters_post] shortcode in versions up to and … | Jul 29, 2026 |