Browse CVEs

HIGH 7.1 CVE-2025-71403 better-auth versions before 1.1.20 contain a bypass vulnerability in trustedOrigins validation logic affecting absolute URLs and wildcard domains. At… No fix yet Fix from $1,9502026-08-01 HIGH 7.5 CVE-2026-18536 Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy:… Data\ 0.010+ Fix from $1,9502026-08-01 MEDIUM 6.5 CVE-2026-6453 The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient inpu… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-18435 The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Blo… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.1 CVE-2026-18344 The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-18062 The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block I… No fix yet Fix from $1,6002026-08-01 MEDIUM 5.3 CVE-2026-18059 The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, … No fix yet Fix from $1,6002026-08-01 MEDIUM 6.6 CVE-2026-17605 The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, … Patch available Fix from $1,6002026-08-01 MEDIUM 6.5 CVE-2026-17580 The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin f… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.1 CVE-2026-17571 The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-16685 The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and incl… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-16684 The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to… No fix yet Fix from $1,6002026-08-01 HIGH 8.8 CVE-2026-16635 The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the `maybe_up… Mitigation only Fix from $1,9502026-08-01 HIGH 8.1 CVE-2026-16144 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includin… No fix yet Fix from $1,9502026-08-01 MEDIUM 6.4 CVE-2026-16091 The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Si… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-16090 The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Si… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.5 CVE-2026-16087 The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Par… No fix yet Fix from $1,6002026-08-01 CRITICAL 9.8 CVE-2026-15964 The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and … No fix yet Fix from $2,3002026-08-01 MEDIUM 6.4 CVE-2026-15950 The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cros… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-15662 The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-15649 The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all vers… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-15645 The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-15644 The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in a… No fix yet Fix from $1,6002026-08-01 HIGH 8.1 CVE-2026-15450 The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and … No fix yet Fix from $1,9502026-08-01 HIGH 7.2 CVE-2026-15052 The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form F… No fix yet Fix from $1,9502026-08-01 MEDIUM 5.3 CVE-2026-15018 The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versio… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-13458 The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up … No fix yet Fix from $1,6002026-08-01 MEDIUM 5.3 CVE-2026-11995 The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorizatio… No fix yet Fix from $1,6002026-08-01 MEDIUM 5.3 CVE-2025-14073 The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in … No fix yet Fix from $1,6002026-08-01 HIGH 8.8 CVE-2026-15988 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,… No fix yet Fix from $1,9502026-08-01