Vulnerabilities
Summary — last 7 days
New vulnerabilities2,647▼ 688 vs. last week
Critical / high1,257▼ 290 vs. last week
New active exploitation (KEV)3▼ 5 vs. last week
Unscored (no CVSS)226▼ 277 vs. last week
402,986 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (8.5) | 0.34% | — | Wp2leadsAI | 10/6/2026 | 10/6/2026 | Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions. | |
| Deferred | High (7.1) | 0.35% | — | Wp2leadsAI | 10/6/2026 | 10/6/2026 | Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. | |
| Deferred | Medium (6.5) | 0.17% | — | Crocoblock JetelementsAI | 10/6/2026 | 10/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2. | |
| Deferred | Low (2.1) | 0.35% | — | Sourcecodester Simple Student Information SystemAI | 10/6/2026 | 10/6/2026 | A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely.… | |
| Deferred | Low (2) | 0.26% | — | Sourcecodester Simple Student Information SystemAI | 10/6/2026 | 10/6/2026 | A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly… | |
| Deferred | High (8.5) | 0.28% | — | Paid Member SubscriptionsAI | 10/6/2026 | 10/6/2026 | Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. | |
| Deferred | High (7.5) | 0.40% | — | SitevaultAI | 10/6/2026 | 10/6/2026 | Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. | |
| Deferred | High (8.8) | 0.29% | — | Salonbookingsystem Salon Booking SystemAI | 10/6/2026 | 10/6/2026 | Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. | |
| Deferred | High (7.1) | 0.24% | — | Wpmailster WP MailsterAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. | |
| Deferred | Medium (6.5) | 0.35% | — | WordpressAI | 10/6/2026 | 10/6/2026 | Subscriber Broken Access Control in Delete All Comments of wordpress <= 7.1 versions. | |
| Deferred | High (8.8) | 0.32% | — | WP User ProfilesAI | 10/6/2026 | 10/6/2026 | Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. | |
| Deferred | Medium (5.3) | 0.32% | — | Zero SpamAI | 10/6/2026 | 10/6/2026 | Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions. | |
| Deferred | High (7.1) | 0.24% | — | Epiph Form BlockAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. | |
| Deferred | High (7.2) | 0.32% | — | Codection Import AND Export Users AND CustomersAI | 10/6/2026 | 10/6/2026 | Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions. | |
| Deferred | High (8.1) | 0.26% | — | HaakenAI | 10/6/2026 | 10/6/2026 | Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. | |
| Deferred | High (7.1) | 0.18% | — | GivewpAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. | |
| Deferred | High (7.1) | 0.18% | — | Thimpress LearnpressAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. | |
| Deferred | High (7.3) | 0.29% | — | PicuAI | 10/6/2026 | 10/6/2026 | Unauthenticated Broken Access Control in picu <= 3.10.1 versions. | |
| Deferred | High (8.1) | 0.28% | — | GivewpAI | 10/6/2026 | 10/6/2026 | Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. | |
| Deferred | Medium (6.9) | 0.41% | — | Stylemixthemes MotorsAI | 10/6/2026 | 10/6/2026 | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124. | |
| Deferred | High (7.1) | 0.24% | — | PicuAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions. | |
| Deferred | High (7.1) | 0.24% | — | CharitableAI | 10/6/2026 | 10/6/2026 | Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. | |
| Deferred | High (7.2) | 0.32% | — | Blubrry PowerpressAI | 10/6/2026 | 10/6/2026 | Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions. | |
| Deferred | High (7.5) | 0.30% | — | GroundhoggAI | 10/6/2026 | 10/6/2026 | Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. | |
| Deferred | High (7.1) | 0.15% | — | Tomlister Payflex Payment GatewayAI | 10/6/2026 | 10/6/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1. |