Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 330new in the last 7 days
- 8added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-119162 | High CVSS 7.2 |
- Applications & supply chain |
The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to… | 31 Oct 2026 |
| CVE-2026-119089 | High CVSS 7.2 |
- Applications & supply chain |
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is… | 31 Oct 2026 |
| CVE-2026-119065 | High CVSS 7.2 |
- Applications & supply chain |
The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 31 Oct 2026 |
| CVE-2026-118070 | High CVSS 7.2 |
- Applications & supply chain |
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in… | 31 Oct 2026 |
| CVE-2026-116557 | Critical CVSS 9.1 |
- Applications & supply chain |
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due… | 31 Oct 2026 |
| CVE-2026-116548 | High CVSS 7.2 |
- Applications & supply chain |
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 31 Oct 2026 |
| CVE-2026-116546 | Medium CVSS 6.4 |
- Applications & supply chain |
The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable… | 31 Oct 2026 |
| CVE-2026-116522 | High CVSS 7.2 |
- Applications & supply chain |
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'… | 31 Oct 2026 |
| CVE-2026-115840 | High CVSS 7.2 |
- Applications & supply chain |
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | 31 Oct 2026 |
| CVE-2026-111109 | Medium CVSS 6.1 |
- Applications & supply chain |
The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag… | 31 Oct 2026 |
| CVE-2026-110251 | Medium CVSS 5.4 |
- Applications & supply chain |
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in… | 31 Oct 2026 |
| CVE-2026-109220 | Critical CVSS 9.8 |
- Applications & supply chain |
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object… | 31 Oct 2026 |
| CVE-2026-107765 | Medium CVSS 6.4 |
- Applications & supply chain |
The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in… | 31 Oct 2026 |
| CVE-2026-107750 | High CVSS 7.2 |
- Applications & supply chain |
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | 31 Oct 2026 |
| CVE-2026-107653 | High CVSS 7.2 |
- Applications & supply chain |
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &… | 31 Oct 2026 |
| CVE-2026-92294 | Medium CVSS 6.5 |
- Applications & supply chain |
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file… | 31 Oct 2026 |
| CVE-2026-82214 | Medium CVSS 5.3 |
- Applications & supply chain |
The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before… | 31 Oct 2026 |
| CVE-2026-119977 | High CVSS 8.1 |
- Applications & supply chain |
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable,… | 31 Oct 2026 |
| CVE-2026-118638 | High CVSS 7.5 |
- Applications & supply chain |
The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that… | 31 Oct 2026 |
| CVE-2026-118629 | Medium CVSS 5.3 |
- Applications & supply chain |
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before… | 31 Oct 2026 |
| CVE-2026-118438 | Medium CVSS 6.8 |
- Applications & supply chain |
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before… | 31 Oct 2026 |
| CVE-2026-118437 | Low CVSS 3.7 |
- Applications & supply chain |
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded… | 31 Oct 2026 |
| CVE-2026-118185 | High CVSS 7.5 |
- Applications & supply chain |
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that… | 31 Oct 2026 |
| CVE-2026-118184 | Medium CVSS 5.3 |
- Applications & supply chain |
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the… | 31 Oct 2026 |
| CVE-2026-118043 | High CVSS 7.2 |
- Applications & supply chain |
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a… | 31 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.