Vulnerabilities
Summary — last 7 days
New vulnerabilities2,662▼ 678 vs. last week
Critical / high1,268▼ 288 vs. last week
New active exploitation (KEV)3▼ 5 vs. last week
Unscored (no CVSS)230▼ 272 vs. last week
402,974 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.1) | 0.27% | — | Mooberry Book ManagerAI | 10/6/2026 | 10/6/2026 | Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions. | |
| Deferred | High (7.5) | 0.31% | — | Woocommerce LotteryAI | 10/6/2026 | 10/6/2026 | Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions. | |
| Deferred | Critical (10) | 0.49% | — | Kognetiks ChatbotAI | 10/6/2026 | 10/6/2026 | Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions. | |
| Deferred | High (7.1) | 0.31% | — | Ecpay EcommerceAI | 10/6/2026 | 10/6/2026 | Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions. | |
| Deferred | High (7.1) | 0.24% | — | Najeebmedia Frontend File ManagerAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions. | |
| Deferred | High (7.1) | 0.24% | — | Sumo Affiliates PROAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions. | |
| Deferred | High (7.1) | 0.24% | — | Rednao Smart FormsAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in Smart Forms <= 2.6.104 versions. | |
| Deferred | High (7.1) | 0.24% | — | Wedevs WP User FrontendAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions. | |
| Deferred | Medium (6.5) | 0.21% | — | Ohio ExtraAI | 10/6/2026 | 10/6/2026 | Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions. | |
| Deferred | High (7.1) | 0.24% | — | ProgressifyAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions. | |
| Deferred | High (7.1) | 0.24% | — | Joomunited WP Media FolderAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions. | |
| Deferred | Critical (9.9) | 0.74% | — | Woocommerce Designer PROAI | 10/6/2026 | 10/6/2026 | Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions. | |
| Deferred | Critical (9.3) | 0.38% | — | Woocommerce AppointmentsAI | 10/6/2026 | 10/6/2026 | Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions. | |
| Deferred | High (8.5) | 0.34% | — | Wp2leadsAI | 10/6/2026 | 10/6/2026 | Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions. | |
| Deferred | High (7.1) | 0.35% | — | Wp2leadsAI | 10/6/2026 | 10/6/2026 | Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. | |
| Deferred | Medium (6.5) | 0.17% | — | Crocoblock JetelementsAI | 10/6/2026 | 10/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2. | |
| Deferred | Low (2.1) | 0.35% | — | Sourcecodester Simple Student Information SystemAI | 10/6/2026 | 10/6/2026 | A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely.… | |
| Deferred | Low (2) | 0.26% | — | Sourcecodester Simple Student Information SystemAI | 10/6/2026 | 10/6/2026 | A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly… | |
| Deferred | High (8.5) | 0.28% | — | Paid Member SubscriptionsAI | 10/6/2026 | 10/6/2026 | Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. | |
| Deferred | High (7.5) | 0.40% | — | SitevaultAI | 10/6/2026 | 10/6/2026 | Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. | |
| Deferred | High (8.8) | 0.29% | — | Salonbookingsystem Salon Booking SystemAI | 10/6/2026 | 10/6/2026 | Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. | |
| Deferred | High (7.1) | 0.24% | — | Wpmailster WP MailsterAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. | |
| Deferred | Medium (6.5) | 0.35% | — | WordpressAI | 10/6/2026 | 10/6/2026 | Subscriber Broken Access Control in Delete All Comments of wordpress <= 7.1 versions. | |
| Deferred | High (8.8) | 0.32% | — | WP User ProfilesAI | 10/6/2026 | 10/6/2026 | Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. | |
| Deferred | Medium (5.3) | 0.32% | — | Zero SpamAI | 10/6/2026 | 10/6/2026 | Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions. |