Browse CVEs

MEDIUM 6.4 CVE-2026-14449 u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components Mitigation only Fix from $1,6002026-07-02 HIGH 7.1 CVE-2025-69156 Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions. Mitigation only Fix from $1,9502026-07-02 HIGH 7.1 CVE-2025-69155 Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions. Mitigation only Fix from $1,9502026-07-02 HIGH 7.1 CVE-2025-69154 Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions. Mitigation only Fix from $1,9502026-07-02 HIGH 7.1 CVE-2025-69153 Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions. Mitigation only Fix from $1,9502026-07-02 HIGH 7.1 CVE-2025-69152 Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions. Mitigation only Fix from $1,9502026-07-02 HIGH 7.5 CVE-2025-69134 Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions. Mitigation only Fix from $1,9502026-07-02 HIGH 7.5 CVE-2025-69133 Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. Mitigation only Fix from $1,9502026-07-02 MEDIUM 6.5 CVE-2025-69132 Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions. Mitigation only Fix from $1,6002026-07-02 HIGH 8.5 CVE-2025-69094 Subscriber SQL Injection in Unicamp <= 2.2.2 versions. Mitigation only Fix from $1,9502026-07-02 MEDIUM 5.3 CVE-2025-66076 Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions. Mitigation only Fix from $1,6002026-07-02 HIGH 8.1 CVE-2025-58902 Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions. Mitigation only Fix from $1,9502026-07-02 HIGH 7.2 CVE-2026-9834 The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all version… Mitigation only Fix from $1,9502026-07-02 MEDIUM 5.3 CVE-2026-9188 The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ve… Mitigation only Fix from $1,6002026-07-02 MEDIUM 6.5 CVE-2026-9145 The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() functio… Mitigation only Fix from $1,6002026-07-02 HIGH 7.5 CVE-2026-8441 The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action i… Mitigation only Fix from $1,9502026-07-02 HIGH 8.2 CVE-2026-14336 PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia… Mitigation only Fix from $1,9502026-07-02 MEDIUM 6.5 CVE-2026-14029 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in… Mitigation only Fix from $1,6002026-07-02 MEDIUM 5.3 CVE-2026-13459 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6… No fix yet Fix from $1,6002026-07-02 HIGH 7.5 CVE-2026-13369 The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and inclu… Mitigation only Fix from $1,9502026-07-02 MEDIUM 6.4 CVE-2026-13252 The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-S… Mitigation only Fix from $1,6002026-07-02 HIGH 7.5 CVE-2026-13251 The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This mak… Mitigation only Fix from $1,9502026-07-02 MEDIUM 5.3 CVE-2026-12657 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ver… Mitigation only Fix from $1,6002026-07-02 MEDIUM 5.3 CVE-2026-12472 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… Mitigation only Fix from $1,6002026-07-02 MEDIUM 5.3 CVE-2026-12122 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions … Mitigation only Fix from $1,6002026-07-02 MEDIUM 5.3 CVE-2026-11896 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… Mitigation only Fix from $1,6002026-07-02 HIGH 8.1 CVE-2026-5821 The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient … Mitigation only Fix from $1,9502026-07-02 MEDIUM 5.3 CVE-2026-5348 The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in vers… Mitigation only Fix from $1,6002026-07-02 HIGH 7.5 CVE-2026-14249 The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action.… Mitigation only Fix from $1,9502026-07-02 MEDIUM 6.4 CVE-2026-13704 The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction… Mitigation only Fix from $1,6002026-07-02