Browse CVEs

MEDIUM 5.3 CVE-2026-15239 The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge … No fix yet Fix from $1,6002026-08-07 MEDIUM 5.9 CVE-2026-15211 The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order bein… No fix yet Fix from $1,6002026-08-07 MEDIUM 5.3 CVE-2026-15148 The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merch… No fix yet Fix from $1,6002026-08-07 MEDIUM 5.3 CVE-2026-12261 A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts pa… No fix yet Fix from $1,6002026-08-07 HIGH 7.3 CVE-2026-19196 A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=… No fix yet Fix from $1,9502026-08-07 MEDIUM 6.5 CVE-2026-16265 The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it disp… No fix yet Fix from $1,6002026-08-07 HIGH 8.8 CVE-2026-16263 The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-contr… No fix yet Fix from $1,9502026-08-07 HIGH 7.5 CVE-2026-16262 The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an un… No fix yet Fix from $1,9502026-08-07 CRITICAL 9.8 CVE-2026-16258 The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to p… No fix yet Fix from $2,3002026-08-07 HIGH 7.5 CVE-2026-16041 The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route,… No fix yet Fix from $1,9502026-08-07 MEDIUM 6.5 CVE-2026-16039 The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated us… No fix yet Fix from $1,6002026-08-07 CRITICAL 9.1 CVE-2026-16038 The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its… No fix yet Fix from $2,3002026-08-07 HIGH 8.1 CVE-2026-16030 The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-base… No fix yet Fix from $1,9502026-08-07 MEDIUM 5.4 CVE-2026-15386 The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds … No fix yet Fix from $1,6002026-08-07 HIGH 8.1 CVE-2026-15361 The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker… No fix yet Fix from $1,9502026-08-07 MEDIUM 6.5 CVE-2026-15359 The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers… No fix yet Fix from $1,6002026-08-07 MEDIUM 5.4 CVE-2026-15245 The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into a… No fix yet Fix from $1,6002026-08-07 HIGH 8.8 CVE-2026-15215 The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscription… No fix yet Fix from $1,9502026-08-07 MEDIUM 6.1 CVE-2026-15032 The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing una… No fix yet Fix from $1,6002026-08-07 HIGH 7.5 CVE-2026-14943 The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API acc… No fix yet Fix from $1,9502026-08-07 MEDIUM 6.1 CVE-2026-14331 The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, le… No fix yet Fix from $1,6002026-08-07 CRITICAL 9.8 CVE-2026-14205 The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price… No fix yet Fix from $2,3002026-08-07 HIGH 7.8 CVE-2026-19195 A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the co… No fix yet Fix from $1,9502026-08-07 HIGH 7.8 CVE-2026-19193 A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter … No fix yet Fix from $1,9502026-08-07 HIGH 7.8 CVE-2026-19192 A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\… No fix yet Fix from $1,9502026-08-07 HIGH 7.8 CVE-2026-19191 A security vulnerability has been detected in StableBit DrivePool 2.3.13.1687. This vulnerability affects unknown code of the file C:\Program Files\S… No fix yet Fix from $1,9502026-08-07 CRITICAL 9.8 CVE-2026-14365 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu… No fix yet Fix from $2,3002026-08-07 CRITICAL 9.8 CVE-2026-14364 The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validati… No fix yet Fix from $2,3002026-08-07 MEDIUM 6.4 CVE-2026-12801 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-sep… No fix yet Fix from $1,6002026-08-07 MEDIUM 6.5 CVE-2026-11907 The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not prop… No fix yet Fix from $1,6002026-08-07