Vulnerabilities
Summary — last 7 days
New vulnerabilities3,229▲ 673 vs. last week
Critical / high1,508▲ 142 vs. last week
New active exploitation (KEV)5▼ 1 vs. last week
Unscored (no CVSS)240▲ 226 vs. last week
404,472 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Medium (5.9) | 0.11% | — | BouncycastleAI | 10/3/2026 | 10/6/2026 | In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements, making the cache line touched a function of the operand, and its fixed-weight support sampler left its duplicate scan as soon as a collision was found… | |
| Deferred | Medium (6.4) | 0.19% | — | Twenty20 Image Before AfterAI | 10/3/2026 | 10/6/2026 | The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access… | |
| Deferred | Critical (9.1) | 0.53% | 💥 PoC | Fastlinemedia Beaver BuilderAI | 10/3/2026 | 10/6/2026 | The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode.… | |
| Deferred | Low (2.1) | 0.43% | — | Linuxmint XreaderAI | 10/3/2026 | 10/6/2026 | A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has… | |
| Deferred | High (7.2) | 0.29% | — | Wpclever WPC Product OptionsAI | 10/3/2026 | 10/6/2026 | The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… | |
| Deferred | Medium (4.3) | 0.30% | — | Burst-statistics Burst StatisticsAI | 10/3/2026 | 10/6/2026 | The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions up to, and including, 3.7.1. This is due to the `maybe_load_shared_dashboard()` handler issuing a genuine WordPress session… | |
| Deferred | High (7.5) | 0.33% | — | WP Visitor StatisticsAI | 10/3/2026 | 10/6/2026 | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it… | |
| Deferred | High (8.1) | 0.29% | — | Nelio ContentAI | 10/3/2026 | 10/6/2026 | The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers,… | |
| Deferred | Medium (6.1) | 0.22% | — | Wpfront Notification BARAI | 10/3/2026 | 10/6/2026 | The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on… | |
| Deferred | High (7.2) | 0.24% | — | Jamesward WP Mail CatcherAI | 10/3/2026 | 10/6/2026 | The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… | |
| Deferred | Medium (6.1) | 0.23% | — | 10web Photo GalleryAI | 10/3/2026 | 10/6/2026 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to… | |
| Deferred | Critical (9.1) | 0.88% | — | Vikappointments Services Booking CalendarAI | 10/3/2026 | 10/6/2026 | The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which… | |
| Deferred | High (7.5) | 0.70% | — | Themewinter WpcafeAI | 10/3/2026 | 10/6/2026 | The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include… | |
| Deferred | High (8.8) | 0.37% | — | Smart ManagerAI | 10/3/2026 | 10/6/2026 | The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the… | |
| Deferred | Medium (6.4) | 0.19% | — | Responsive PlusAI | 10/3/2026 | 10/6/2026 | The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… | |
| Deferred | Medium (5.3) | 0.36% | — | Themewinter WpcafeAI | 10/3/2026 | 10/6/2026 | The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated… | |
| Deferred | Medium (6.1) | 0.21% | — | Wpclever WPC Estimated Delivery DateAI | 10/3/2026 | 10/6/2026 | The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… | |
| Deferred | Medium (5.4) | 0.27% | — | Wpmet WP Ultimate ReviewAI | 10/3/2026 | 10/6/2026 | The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated… | |
| Deferred | Medium (5.4) | 0.22% | — | Wpmobile APPAI | 10/3/2026 | 10/6/2026 | The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This makes it possible for… | |
| Deferred | Medium (6.5) | 0.28% | — | Wpmet WP Ultimate ReviewAI | 10/3/2026 | 10/6/2026 | The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated… | |
| Deferred | Medium (6.4) | 0.19% | — | Wpmet WP Social Login AND Register Social CounterAI | 10/3/2026 | 10/6/2026 | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated… | |
| Deferred | High (7.2) | 0.27% | — | Wp-buy Visitor Traffic Real Time StatisticsAI | 10/3/2026 | 10/6/2026 | The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject… | |
| Deferred | High (7.5) | 0.37% | — | Simple-membership-plugin Simple MembershipAI | 10/3/2026 | 10/6/2026 | The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from SwpmInitTimeTasks::check_and_do_email_activation() on… | |
| Deferred | Low (3.7) | 0.17% | — | Genetechsolutions PIE RegisterAI | 10/3/2026 | 10/6/2026 | The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code. | |
| Deferred | High (7.2) | 0.26% | — | Strong TestimonialsAI | 10/3/2026 | 10/6/2026 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts… |