CVE Feed

Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24.

Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.

Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.

Subscriber Broken Access Control in Gravity Booster &#8211; Styles &amp; Layouts for Gravity Forms <= 6.0 versions.

Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Upload a Web Shell to a Web Server.This issue affects Masteriyo - LMS: from n/a through 2.3.2.

Subscriber Broken Authentication in User Registration <= 5.2.6 versions.

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.

Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions.

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-12965.

Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.2.0.

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.

Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.

Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.

Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858