UpHeron
All posts

Daily summary

Vulnerabilities of 7 November 2026: 205 new, 5 critical

205 vulnerabilities added on 7 November 2026, 5 critical and 45 high: Remote code execution in WordPress plugins, Authentication bypass in WordPress plugins, Privilege escalation in WordPress plugins and more.

  • 5 critical
  • 45 high
  • 140 medium
  • 1 low
  • 14 unrated

Remote code execution in WordPress plugins

4 vulnerabilities

  1. 9.8payever – WooCommerce GatewayUnauthenticated Arbitrary File Upload Leading to Remote Code ExecutionUp to 4.8.0CVE-2026-93754
  2. 8.8QA AssistantsUnauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' ParametersUp to 5.3.0CVE-2026-87112
  3. 6.5Dynific Addons for Elementor (formerly Anywhere Elementor)Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template bufferUp to 1.3.0CVE-2026-102564
  4. 6.5Quiz and Survey Master (QSM)Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' ParameterUp to 11.2.7CVE-2026-103917

Authentication bypass in WordPress plugins

3 vulnerabilities

  1. 9.8Naimur Email OTP Verification for WooCommerceUnauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset FinalizationUp to 2.1.0CVE-2026-104014
  2. 9.1Appointment BookingUnauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' ParameterUp to 5.7.6CVE-2026-118066
  3. 5.3Simple Cloudflare TurnstileUp to 1.44.4CVE-2026-119498

Privilege escalation in WordPress plugins

3 vulnerabilities

  1. 9.8Registration Form for WooCommerceUnauthenticated Privilege Escalation to 'user_roles' Parameter at CheckoutUp to 1.1.4CVE-2026-119075
  2. 8.1WPJAM BasicUnauthenticated Privilege Escalation to 'data[args][role]' ParameterUp to 7.1CVE-2026-103900
  3. 7.5AutomatorWPUnauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' OptionUp to 6.0.4CVE-2026-104768

Arbitrary file upload in WordPress plugins

2 vulnerabilities

  1. 9.8Printcart StoreUnauthenticated Arbitrary File Upload via nbu_crop_image 'url' ParameterUp to 2.13.2CVE-2026-19803
  2. 8.8Interactive Real EstateAuthenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.jsonUp to 2.6.0CVE-2026-104913

Cross-site request forgery in WordPress plugins

4 vulnerabilities

  1. 8.8PowerPress PodcastingUp to 11.18.0CVE-2026-121762
  2. 8.8Superb Addons: Blocks, Patterns &Up to 4.2.4CVE-2026-66669
  3. 6.3Photo Gallery by SupsysticUp to 1.21.6CVE-2026-119484
  4. 5.4Wp SocialUp to 3.2.3CVE-2026-122675

File inclusion in WordPress plugins

3 vulnerabilities

  1. 8.8WpTravellyUp to 2.3.8CVE-2026-120839
  2. 8.8WpTravellyUp to 2.3.8CVE-2026-120841
  3. 5.9NoptinUnauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_nameUp to 4.4.3CVE-2026-119616

WP Data Access

6 vulnerabilities · WordPress plugins

  1. 8.1Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insertUp to 5.5.89CVE-2026-118267
  2. 6.5Cross Site Request Forgery (CSRF)Up to 5.5.90CVE-2026-121783
  3. 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project FormUp to 5.5.90CVE-2026-120479
  4. 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column RendererUp to 5.5.89CVE-2026-118204
  5. 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup LabelUp to 5.5.89CVE-2026-118048
  6. 5.3Authenticated (Subscriber+) SQL Injection via 'engine' ParameterUp to 5.5.90CVE-2026-121536

Motors

4 vulnerabilities · WordPress plugins

  1. 8.1Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User MetaUp to 1.4.125CVE-2026-104746
  2. 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' ParameterUp to 1.4.128CVE-2026-116562
  3. 4.3Broken Access ControlUp to 1.4.128CVE-2026-123467
  4. 4.3Broken Access ControlUp to 1.4.128CVE-2026-123468

Broken access control in WordPress plugins

49 vulnerabilities

  1. 7.5FunnelKit Payment Gateway for Stripe WooCommerceInsecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path ParameterUp to 1.15.0.2CVE-2026-109991
  2. 7.5Booking for Appointments and Events CalendarMissing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' EndpointUp to 9.9.1CVE-2026-107616
  3. 6.5Meta Box – WordPress Custom Fields FrameworkUp to 5.15.3CVE-2026-120836
  4. 6.5Booking for Appointments and Events CalendarMissing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' EndpointUp to 9.9.1CVE-2026-104992
  5. 6.5Tutor LMSInsecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API EndpointsUp to 4.1.2CVE-2026-93779
Show 44 more
  1. 5.9Jupiter X CoreMissing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' ParameterUp to 4.62.0CVE-2026-120737
  2. 5.4Fluent BookingUp to 2.5.0CVE-2026-122659
  3. 5.4PowerPress PodcastingUp to 11.18.0CVE-2026-121766
  4. 5.4LearnPressUp to 4.4.12CVE-2026-52713
  5. 5.4AnyWhere ElementorUp to 1.3.0CVE-2026-119467
  6. 5.3User RegistrationUp to 5.3.1CVE-2026-119522
  7. 5.3FOXUp to 1.5.6CVE-2026-123461
  8. 5.3User RegistrationUp to 5.3.1CVE-2026-124258
  9. 5.3JetFormBuilder – Hierarchical SelectUp to 1.0.10CVE-2026-123861
  10. 5.3WP User ManagerUp to 2.10.4CVE-2026-121575
  11. 5.3Premium Blocks – Gutenberg Blocks for WordPressUp to 2.3.18CVE-2026-123474
  12. 5.3CURCYUp to 2.2.20CVE-2026-121775
  13. 5.3myCredUp to 4.0.2CVE-2026-123462
  14. 5.3CURCYUp to 2.2.20CVE-2026-122663
  15. 5.3Autopay dla WooCommerceUp to 2.3.0CVE-2026-121571
  16. 5.3JS Help DeskUp to 5.0.3CVE-2026-119513
  17. 5.32Way VideoCalls and Random ChatUp to 6.1.9CVE-2026-120857
  18. 5.3IvyFormsUp to 1.5.1CVE-2026-123148
  19. 5.3Paid Member SubscriptionsUp to 3.1.3CVE-2026-119523
  20. 5.3Radius BookingUp to 1.0.20CVE-2026-119508
  21. 5.3SureFormsUp to 2.13.0CVE-2026-120842
  22. 5.3Ultimate Store Kit Elementor AddonsUp to 4.0.1CVE-2026-119502
  23. 5.3CartFlowsUp to 3.3.0CVE-2026-120853
  24. 5.3MC Woocommerce WishlistUp to 2.0.3CVE-2026-119511
  25. 5.3Premium Blocks – Gutenberg Blocks for WordPressUp to 2.3.18CVE-2026-123466
  26. 5.3Fluent BookingUp to 2.5.0CVE-2026-121781
  27. 5.3myCredUp to 4.0.2CVE-2026-124274
  28. 5.3weDocsUp to 2.6.1CVE-2026-121767
  29. 5.3WP-Lister Lite for AmazonUp to 2.9.2CVE-2026-121778
  30. 5.3Redux FrameworkMissing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX ActionUp to 4.5.16CVE-2026-110705
  31. 5.3Jupiter X CoreMissing Authorization to Unauthenticated Limited File Download via 'file' ParameterUp to 4.62.0CVE-2026-120555
  32. 4.3FloristPressUp to 7.8.5CVE-2026-122660
  33. 4.3HivePressUp to 1.8.1CVE-2026-123470
  34. 4.3Everest FormsUp to 3.6.3CVE-2026-120837
  35. 4.3Contextual Related PostsUp to 4.5.3CVE-2026-121724
  36. 4.3Dropshipping XML for WooCommerceUp to 1.7.4CVE-2026-119525
  37. 4.3FluentBoardsUp to 2.2.2CVE-2026-119486
  38. 4.3User RegistrationUp to 5.3.0CVE-2026-120840
  39. 4.3myCredUp to 4.0.2CVE-2026-122668
  40. 4.3Media LIbrary AssistantUp to 3.43CVE-2026-119491
  41. 4.3WCFM MembershipUp to 2.12.0CVE-2026-61990
  42. 4.3MetformUp to 4.3.3CVE-2026-120847
  43. 4.3WCFM MarketplaceUp to 3.8.3CVE-2026-120849
  44. 4.3VOD InfomaniakUp to 1.5.15CVE-2026-121761

SQL injection in WordPress plugins

5 vulnerabilities

  1. 7.5Amelia ProUnauthenticated SQL Injection via 'tag' Parameter Array KeysUp to 9.9.1CVE-2026-116751
  2. 7.5Affiliate Program SuiteUnauthenticated SQL Injection via 'email' ParameterUp to 1.2.14CVE-2026-120043
  3. 6.5Dynific Addons for Elementor (formerly Anywhere Elementor)Authenticated (Subscriber+) SQL Injection via 'q' ParameterUp to 1.3CVE-2026-103914
  4. 6.5GamiPressAuthenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' ParameterUp to 8.1.1CVE-2026-121792
  5. 5.7WebToffee WP Backup and MigrationAuthenticated (Subscriber+) SQL Injection via User Profile BiographyUp to 1.6.1CVE-2026-120530

wpForo Forum

5 vulnerabilities · WordPress plugins

  1. 7.5Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV ParameterUp to 3.2.2CVE-2026-119164
  2. 7.5Unauthenticated SQL Injection via 'data' ParameterUp to 3.2.1CVE-2026-95870
  3. 7.5Unauthenticated SQL Injection via 'href[locale]' ParameterUp to 3.2.2CVE-2026-119155
  4. 6.5Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' ParameterUp to 3.2.2CVE-2026-110004
  5. 6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation FormsUp to 3.2.2CVE-2026-120532

Cross-site scripting in WordPress plugins

73 vulnerabilities

  1. 7.2Download ManagerUnauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]Up to 7.5.9CVE-2026-119156
  2. 7.2VikBooking Hotel Booking Engine & PMSUnauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' ParameterUp to 1.8.17CVE-2026-93429
  3. 7.2Quttera ThreatSignUnauthenticated Stored Cross-Site Scripting via User-Agent HeaderUp to 4.1.0.48CVE-2026-115548
  4. 7.2User FrontendUnauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-InputUp to 4.3.13CVE-2026-109214
  5. 7.2WP Visitor Statistics (Real Time Traffic)Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker ParametersUp to 8.9.0CVE-2026-111370
Show 68 more
  1. 7.2Church AdminUnauthenticated Stored Cross-Site Scripting via 'lat' ParameterUp to 5.1.7CVE-2026-123418
  2. 7.2WS Form LITEUnauthenticated Stored Cross-Site Scripting via Text Field Array ValueUp to 1.12.18CVE-2026-122231
  3. 7.2WP Visitor Statistics (Real Time Traffic)Unauthenticated Stored Cross-Site Scripting via 'browser' ParameterUp to 8.7.1CVE-2026-109230
  4. 7.2Happyforms ProUnauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' ParameterUp to 1.38.9CVE-2026-93766
  5. 7.2Link LibraryUnauthenticated Stored Cross-Site Scripting via 'link_description' ParameterUp to 7.10.0CVE-2026-116537
  6. 7.2Strong TestimonialsUnauthenticated Stored Cross-Site Scripting via 'star_rating' ParameterUp to 3.3.16CVE-2026-115811
  7. 7.2AgenWebsite ShippingUnauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup WizardUp to 9.2.41CVE-2026-122037
  8. 7.2Unlimited Elements for ElementorUnauthenticated Stored Cross-Site Scripting via RSS Feed WidgetUp to 2.0.26CVE-2026-116558
  9. 7.2Pie RegisterUnauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment AvatarUp to 3.8.4.16CVE-2026-119158
  10. 7.2OptimoleUnauthenticated Stored Cross-Site Scripting via Comment ContentUp to 4.2.18CVE-2026-120677
  11. 7.2OptimoleUnauthenticated Stored Cross-Site Scripting via Page Profiler srcset DescriptorUp to 4.2.18CVE-2026-120739
  12. 7.2Iubenda Cookie Law SolutionUnauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE-BLOCK MarkerUp to 3.13.6CVE-2026-120540
  13. 7.2Nazy LoadUnauthenticated Stored Cross-Site Scripting via Comment ContentUp to 2.4.15CVE-2026-119175
  14. 7.2GeoDirectoryUnauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_contentUp to 2.8.200CVE-2026-120082
  15. 7.2OptimoleUnauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL ReplacerUp to 4.2.17CVE-2026-119070
  16. 7.2Form Maker by 10WebUnauthenticated Stored Cross-Site Scripting via Hidden Input Field ValueUp to 1.15.50CVE-2026-120512
  17. 7.2Translatepress MultilingualVulnerability in TranslatePress – Translate Multilingual sites with AI TranslationFixed in 3.3.9CVE-2026-120537
  18. 7.2Translatepress MultilingualVulnerability in TranslatePress – Translate Multilingual sites with AI TranslationFixed in 3.3.9CVE-2026-119167
  19. 7.1TranslatePressUp to 3.3.8CVE-2026-121765
  20. 6.5Meta Box – WordPress Custom Fields FrameworkUp to 5.15.3CVE-2026-123472
  21. 6.5Unlimited Elements For ElementorUp to 2.0.26CVE-2026-121579
  22. 6.5Everest FormsUp to 3.6.3CVE-2026-122669
  23. 6.5WpBookinglyUp to 1.4.3CVE-2026-121784
  24. 6.5JetEngineUp to 3.9.0.2CVE-2026-123477
  25. 6.5VidplexUp to 1.0.3CVE-2026-120364
  26. 6.5WP Customer AreaUp to 8.4.3CVE-2026-120365
  27. 6.5Element Pack Elementor AddonsUp to 10.0.2CVE-2026-119501
  28. 6.5Flash & HTML5 VideoUp to 2.14.1CVE-2026-119500
  29. 6.5SpectraUp to 2.20.4CVE-2026-119520
  30. 6.5Elementor Website BuilderUp to 4.3.5CVE-2026-120850
  31. 6.5DittyUp to 3.1.71CVE-2026-119493
  32. 6.5The Events CalendarUp to 6.18.3CVE-2026-123464
  33. 6.5Contact Form 7 – Post FieldsUp to 2.6.0CVE-2026-121768
  34. 6.5MC Woocommerce WishlistUp to 2.0.3CVE-2026-119510
  35. 6.5WP Recipe MakerUp to 10.9.1CVE-2026-119489
  36. 6.5WCFM MarketplaceUp to 3.8.3CVE-2026-120848
  37. 6.4FlipboxAuthenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' ParameterUp to 3.1.1CVE-2026-109973
  38. 6.4Active Woot Products Tables for WooCommerce. 100% FREEAuthenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode AttributeUp to 2.1.5CVE-2026-120579
  39. 6.4Football PoolAuthenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox MessageUp to 2.13.5CVE-2026-118050
  40. 6.4Modula Image GalleryAuthenticated (Author+) Stored Cross-Site Scripting via 'items' ParameterUp to 3.0.17CVE-2026-121976
  41. 6.4WedocsAuthenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block AttributeUp to 2.6.1CVE-2026-104760
  42. 6.4WP-Members MembershipAuthenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect FieldUp to 3.5.7CVE-2026-96565
  43. 6.4WP ImageViewerAuthenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' AttributeUp to 3.0.2CVE-2026-122059
  44. 6.4Falang multilanguage for WordPressAuthenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hookUp to 1.4.6CVE-2026-118047
  45. 6.4WPSpeedAuthenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display NameUp to 2.6.10CVE-2026-118784
  46. 6.4aBlocksAuthenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block AttributeUp to 2.18.0CVE-2026-118800
  47. 6.4Ultimate MemberAuthenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile FieldUp to 2.14.1CVE-2026-116621
  48. 6.4SEOPressAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking'…Up to 10.3CVE-2026-120515
  49. 6.4Redux FrameworkAuthenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme NameUp to 4.5.16CVE-2026-110534
  50. 6.4StackableAuthenticated (Contributor+) Stored Cross-Site Scripting via 'save' ParameterUp to 3.19.9CVE-2026-9601
  51. 6.4Kubio AI Page BuilderAuthenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product ReviewUp to 2.9.4CVE-2026-115816
  52. 6.4LifterLMSAuthenticated (Subscriber+) Stored Cross-Site Scripting via Content Question AnswerUp to 10.3.2CVE-2026-119098
  53. 6.4Social Slider FeedAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' ParameterUp to 2.3.8CVE-2026-121519
  54. 6.4JS Help DeskAuthenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-titleUp to 5.0.2CVE-2026-118046
  55. 6.4LearnPressAuthenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' ParameterUp to 4.2.2CVE-2026-118054
  56. 6.1QODE Wishlist for WooCommerceUnauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest CookieUp to 1.2.9CVE-2026-121516
  57. 5.4Real TestimonialsUnauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode ChainUp to 4.1.0CVE-2026-120685
  58. 5.4Real TestimonialsUnauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' ParameterUp to 4.1.0CVE-2026-120683
  59. 5.4Zephyr Project ManagerAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' ParameterUp to 3.3.209CVE-2026-120514
  60. 5.4GreenshiftUnauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefixUp to 13.2.2CVE-2026-119218
  61. 5.4MotoPress Appointment BookingUnauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST EndpointUp to 2.4.8CVE-2026-120741
  62. 5.4Form Maker by 10WebUnauthenticated Stored Cross-Site Scripting via disabled_fields ParameterUp to 1.15.50CVE-2026-118067
  63. 5.4FV Flowplayer Video PlayerUnauthenticated Stored Cross-Site Scripting via Comment ContentUp to 7.5.56.7212CVE-2026-121515
  64. 5.4Appointment BookingUnauthenticated Stored Cross-Site Scripting via Customer Email FieldUp to 5.7.6CVE-2026-119152
  65. 5.4Jupiter X CoreUnauthenticated Stored Cross-Site Scripting via Raven Register Custom User MetaUp to 4.62.0CVE-2026-119219
  66. 4.9Image Hover Effects UltimateAuthenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' ParameterUp to 9.12.2CVE-2026-118056
  67. 4.7Real TestimonialsUnauthenticated Stored Cross-Site Scripting via 'tpro_client_name' ParameterUp to 4.1.0CVE-2026-120509
  68. 4.7Stop Spammers ClassicUnauthenticated Stored Cross-Site Scripting via 'author' ParameterUp to 2026.6CVE-2026-120477

JetFormBuilder

5 vulnerabilities · WordPress plugins

  1. 7.2Unauthenticated Stored Cross-Site Scripting via Form Record Preset SourceUp to 3.6.7CVE-2026-111317
  2. 7.2Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post MetaUp to 3.6.8CVE-2026-119183
  3. 5.4Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` PropertyUp to 3.6.8CVE-2026-121977
  4. 5.3Content InjectionUp to 3.6.8CVE-2026-123860
  5. 5.3Content InjectionUp to 3.6.8CVE-2026-123483

Arbitrary file access in WordPress plugins

2 vulnerabilities

  1. 6.5Active Woot Products Tables for WooCommerce. 100% FREEUnauthenticated File Deletion via 'wp_columns_actions' and 'table_id' ParametersUp to 2.1.5CVE-2026-120560
  2. 5.9Vanquish Upload Files for WooCommerceUnauthenticated Arbitrary File Read via 'vanupfi_file_name' ParameterUp to 2.7.13CVE-2026-122265

Content injection in WordPress plugins

12 vulnerabilities

  1. 5.3Cool Formkit LiteUp to 2.7.10CVE-2026-121777
  2. 5.3Active Products Tables for WooCommerceUp to 2.1.6CVE-2026-123183
  3. 5.3Media LIbrary AssistantUp to 3.43CVE-2026-119496
  4. 5.3Better Notifications for WPUp to 1.10.1CVE-2026-119490
  5. 5.3Site ReviewsUp to 8.3.6CVE-2026-119494
Show 7 more
  1. 5.3NotificationXUp to 3.3.6CVE-2026-119507
  2. 5.3CartFlowsUp to 3.3.0CVE-2026-120852
  3. 5.3The Events CalendarUp to 6.18.3CVE-2026-123469
  4. 5.3ProfilePressUp to 4.17.7CVE-2026-39733
  5. 4.3MasterStudy LMSUp to 3.7.56CVE-2026-119478
  6. 4.3DittyUp to 3.1.71CVE-2026-119492
  7. 4.3ProfilePressUp to 4.17.7CVE-2026-119473

Sensitive data exposure in WordPress plugins

6 vulnerabilities

  1. 5.3Elementor Addon ElementsUp to 1.15CVE-2026-119465
  2. 5.3YML for Yandex MarketUnauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.phpUp to 5.10.0CVE-2026-120548
  3. 5.3YITH WooCommerce SubscriptionUp to 4.22.0CVE-2026-121779
  4. 5.3Paystack WooCommerce Payment GatewayUnauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay EndpointUp to 5.8.5CVE-2026-93370
  5. 5.3GreenshiftUnauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} ParameterUp to 13.2.2CVE-2026-120520
  6. 4.3aBlocksAuthenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' ShortcodeUp to 2.18.0CVE-2026-118801

Linux kernel

14 vulnerabilities · Servers and applications · most fixed in 6.18.61, 7.3.2

  1. –net: skbuff: propagate shared-frag marker in skb_zerocopy()Fixed in 7.2.15, 7.3.2CVE-2026-99284
  2. –netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packetsFixed in 6.18.61, 7.3CVE-2026-99283
  3. –ksmbd: reclaim ended sessions on logoff and expirationFixed in 7.3, 7.3.2CVE-2026-99279
  4. –ksmbd: drain session procfs readers before dropping table referencesFixed in 7.3, 7.3.2CVE-2026-99280
  5. –tun: Require CAP_NET_ADMIN to attach to an ownerless deviceFixed in 6.18.61, 7.3.2CVE-2026-99281
Show 9 more
  1. –net/sched: sch_teql: fix use-after-free on lower qdisc dropFixed in 6.18.61, 7.3.2CVE-2026-99282
  2. –smb: client: reject short SESSION_SETUP responsesFixed in 7.3.2CVE-2026-99275
  3. –ksmbd: defer connection scavenging while session locks are busyFixed in 7.3, 7.3.2CVE-2026-99276
  4. –ksmbd: hold a connection reference for each session channelFixed in 7.3, 7.3.2CVE-2026-99277
  5. –ksmbd: limit sessions on each connectionFixed in 7.3, 7.3.2CVE-2026-99278
  6. –ALSA: line6: Clear prev_fbuf on capture buffer releaseFixed in 6.18.61, 7.3.2CVE-2026-99271
  7. –smb: client: validate the data area in SMB2_read()Fixed in 7.3.2CVE-2026-99272
  8. –ksmbd: reserve space for the UTF-16 terminator in stream infoFixed in 6.18.61, 7.3.2CVE-2026-99273
  9. –smb: client: fix fiemap wild read on empty truncated responseFixed in 6.18.61, 7.3.2CVE-2026-99274

Other vulnerabilities in WordPress plugins

2 vulnerabilities

  1. 8.1Advanced Form IntegrationUnauthenticated PHP Object Injection via $_POST ParametersUp to 2.10.2CVE-2026-104738
  2. 3.7Fluent Support— Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms FeedUp to 2.4.7CVE-2026-119213

Servers and applications

3 vulnerabilities

  1. HighFrappe FrameworkUnauthorized document submission and modification due to missing validation in Document.update()Fixed in 15.122.0, 16.50.0GHSA-37jh-f235-72qp
  2. 6.3Expatlibexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16Up to 2.10.0CVE-2026-124317
  3. 5.3vLLMResponse amplification in OpenAI validation error handlerFixed in 0.30.0GHSA-mwgq-9582-w2vf

From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.