Skip to content
OpenAdvisories

Archive

January 2026

Vulnerabilities first published in this month (UTC), newest first.

← December 2025 2026 / January February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

1,804 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-24561

    WordPress FluentBoards plugin <= 1.91.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.1.

    Mahmudul Hasan Arif FluentBoards
  • Medium 6.5
    CVE-2026-24558

    WordPress ABG Rich Pins plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antoniobg ABG Rich Pins abg-rich-pins allows Stored XSS.This issue affects ABG Rich Pins: from n/a through <= 1.1.

    antoniobg ABG Rich Pins
  • Medium 5.3
    CVE-2026-24559

    WordPress Integration for Contact Form 7 HubSpot plugin <= 1.4.3 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Retrieve Embedded Sensitive Data.This issue affects Integration for Contact Form 7 HubSpot: from n/a through <= 1.4.3.

    CRM Perks Integration for Contact Form 7 HubSpot
  • Medium 5.3
    CVE-2026-24557

    WordPress Contact Form 7 GetResponse Extension plugin <= 1.0.8 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in WEN Solutions Contact Form 7 GetResponse Extension contact-form-7-getresponse-extension allows Retrieve Embedded Sensitive Data.This issue affects Contact Form 7 GetResponse Extension: from n/…

    WEN Solutions Contact Form 7 GetResponse Extension
  • Medium 5.4
    CVE-2026-24560

    WordPress Cloudinary plugin <= 3.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cloudinary Cloudinary cloudinary-image-management-and-manipulation-in-the-cloud-cdn allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cloudinary: from n/a through <= 3.3.2.

    Cloudinary Cloudinary
  • Medium 4.3
    CVE-2026-24553

    WordPress Fraud Prevention For Woocommerce plugin <= 2.3.2 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Retrieve Embedded Sensitive Data.This issue affects…

    Dotstore Fraud Prevention For Woocommerce Web / CMS
  • Medium 5.4
    CVE-2026-24551

    WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Monetag Official Plugin: from n/a through <= 1.1.3.

    monetagwp Monetag Official Plugin
  • Medium 5.3
    CVE-2026-24556

    WordPress ElementCamp plugin <= 2.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementCamp: from n/a through <= 2.3.2.

    wpdive ElementCamp
  • Medium 6.5
    CVE-2026-24555

    WordPress ArtPlacer Widget plugin <= 2.23.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Stored XSS.This issue affects ArtPlacer Widget: from n/a through <= 2.23.2.

    artplacer ArtPlacer Widget
  • Medium 6.5
    CVE-2026-24550

    WordPress Blockons plugin <= 1.2.19 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaira Blockons blockons allows Stored XSS.This issue affects Blockons: from n/a through <= 1.2.19.

    Kaira Blockons
  • Medium 4.3
    CVE-2026-24543

    WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a through <= 1.3.52.

    Horea Radu Materialis Companion
  • Medium 4.3
    CVE-2026-24549

    WordPress GeoDirectory plugin <= 2.8.149 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Paolo GeoDirectory geodirectory allows Cross Site Request Forgery.This issue affects GeoDirectory: from n/a through <= 2.8.149.

    Paolo GeoDirectory
  • Medium 5.4
    CVE-2026-24548

    WordPress Radio Player plugin <= 2.0.91 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: from n/a through <= 2.0.91.

    princeahmed Radio Player
  • Medium 4.3
    CVE-2026-24542

    WordPress WP Term Order plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Term Order wp-term-order allows Cross Site Request Forgery.This issue affects WP Term Order: from n/a through <= 2.1.0.

    John James Jacoby WP Term Order
  • Medium 5.3
    CVE-2026-24541

    WordPress Download After Email plugin <= 2.1.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download After Email: from n/a through <= 2.1.9.

    mkscripts Download After Email
  • Medium 4.3
    CVE-2026-24544

    WordPress HD Quiz plugin <= 2.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Harmonic Design HD Quiz hd-quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HD Quiz: from n/a through <= 2.0.9.

    harmonic_design HD Quiz
  • Medium 5.3
    CVE-2026-24536

    WordPress Webpushr plugin <= 4.38.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through <= 4.38.0.

    webpushr Webpushr
  • Medium 4.3
    CVE-2026-24535

    WordPress Automatic Featured Images from Videos plugin <= 1.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic Featured Images from Videos: …

    webdevstudios Automatic Featured Images from Videos
  • Medium 5.3
    CVE-2026-24539

    WordPress Protección de datos – RGPD plugin <= 0.68 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ABCdatos Protección de datos – RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protección de datos – RGPD: from n/a through <= 0.68.

    ABCdatos Protección de datos – RGPD
  • Medium 5.4
    CVE-2026-24540

    WordPress Integrate Google Drive plugin <= 1.5.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integrate Google Drive: from n/a through <= 1.5.6.

    princeahmed Integrate Google Drive
  • Medium 5.3
    CVE-2026-24530

    WordPress WebP Conversion plugin <= 2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sheepfish WebP Conversion webp-conversion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebP Conversion: from n/a through <= 2.2.

    sheepfish WebP Conversion
  • Medium 4.3
    CVE-2026-24532

    WordPress SiteLock Security plugin <= 5.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Securi…

    SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans
  • Medium 4.3
    CVE-2026-24534

    WordPress Booter plugin <= 1.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in uPress Booter booter-bots-crawlers-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booter: from n/a through <= 1.5.7.

    uPress Booter
  • Medium 5.3
    CVE-2026-24525

    WordPress CLP Varnish Cache plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CloudPanel CLP Varnish Cache clp-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CLP Varnish Cache: from n/a through <= 1.0.2.

    CloudPanel CLP Varnish Cache
  • Medium 6.5
    CVE-2026-24526

    WordPress Email Inquiry & Cart Options for WooCommerce plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Truman Email Inquiry & Cart Options for WooCommerce woocommerce-email-inquiry-cart-options allows DOM-Based XSS.This issue affects Email Inquiry & Cart…

    Steve Truman Email Inquiry & Cart Options for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-24528

    WordPress Nova Blocks plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.This issue affects Nova Blocks: from n/a through <= 2.1.9.

    pixelgrade Nova Blocks
  • Medium 5.3
    CVE-2026-24529

    WordPress Quick Restaurant Reservations plugin <= 1.6.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Alejandro Quick Restaurant Reservations quick-restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Restaurant Reservations: from n/a through <= 1.6.7.

    Alejandro Quick Restaurant Reservations
  • Medium 4.3
    CVE-2026-24521

    WordPress Kama Thumbnail plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Timur Kamaev Kama Thumbnail kama-thumbnail allows Cross Site Request Forgery.This issue affects Kama Thumbnail: from n/a through <= 3.5.1.

    Timur Kamaev Kama Thumbnail
  • Medium 4.3
    CVE-2026-24524

    WordPress Tablesome plugin <= 1.2.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.2.8.

    Essekia Tablesome
  • Medium 4.3
    CVE-2026-24522

    WordPress WP Subscribe plugin <= 1.2.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MyThemeShop WP Subscribe wp-subscribe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Subscribe: from n/a through <= 1.2.16.

    mythemeshop WP Subscribe
  • Medium 5.3
    CVE-2026-24523

    WordPress WP FullCalendar plugin <= 1.6 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.

    Marcus (aka @msykes) WP FullCalendar
  • Medium 4.3
    CVE-2025-13921

    weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update

    The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data due to a missing capability check on the 'wedocs_user_documentation_handling_capabilities' function i…

    wedevs weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot Web / CMS
  • Medium 6.4
    CVE-2026-0914

    WP DSGVO Tools (GDPR) <= 3.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcode

    The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lw_content_block' shortcode in all versions up to, and including, 3.1.36 due to insufficient input sanitization and output escaping on user supplied …

    legalweb WP DSGVO Tools (GDPR) Web / CMS
  • Medium 4.7
    CVE-2025-2204

    XSS in Tapandsign Technologies' Tap&Sign App

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tapandsign Technologies Software Inc. Tap&Sign allows Cross-Site Scripting (XSS). This issue affects Tap&Sign: through 23012026. NOTE: The vendor was …

    Tapandsign Technologies Software Tap&Sign
  • Medium 4.3
    CVE-2025-46699

    Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in …

    Dell Data Protection Advisor
  • Medium 5.5
    CVE-2026-22276

    Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storag…

    Dell ObjectScale
  • Medium 4.4
    CVE-2026-22275

    Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Inclusion of Se…

    Dell ObjectScale
  • Medium 6.5
    CVE-2026-22274

    Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transm…

    Dell ObjectScale
  • Medium 6.4
    CVE-2025-14745

    RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode

    The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp-rss-aggregator' shortcode in all versions up to, and including, 5.0.10 due to insufficient input…

    rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Web / CMS
  • Medium 6.4
    CVE-2025-14069

    Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema

    The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping…

    Magazine3 Schema & Structured Data for WP & AMP Web / CMS