Skip to content
OpenAdvisories

Archive

31 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /31 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-1165

    Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change

    The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather tha…

    Ays Pro Popup Box – Create Countdown, Coupon, Video, Contact Form Popups Web / CMS
  • Medium 5.4
    CVE-2026-1251

    SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference

    The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'add_reply' function due to missing validation on a user controlled key. Th…

    PSM Plugins SupportCandy – Helpdesk & Customer Support Ticket System Web / CMS
  • Medium 6.5
    CVE-2026-0683

    SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter

    The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4. This is due to insufficient escaping on the user-supplied ope…

    PSM Plugins SupportCandy – Helpdesk & Customer Support Ticket System Web / CMS
  • Medium 5.3
    CVE-2025-15525

    Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure

    The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possib…

    dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy Load Web / CMS
  • Medium 5.3
    CVE-2026-1431

    Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure

    The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticat…

    wpdevelop Booking Calendar Web / CMS
  • Medium 5.3
    CVE-2025-15510

    NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure

    The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticate…

    webaways NEX-Forms – Ultimate Forms Plugin for WordPress Web / CMS