Skip to content
OpenAdvisories

Archive

January 2026

Vulnerabilities first published in this month (UTC), newest first.

← December 2025 2026 / January February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

4,331 results · Feed

  • High 8.2
    CVE-2026-0994 Public exploit

    Denial of Service in Python Protobuf

    A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…

    Python Protobuf mysql open-webui Debian Ubuntu Azure Linux Wolfi PyPI
  • High 7.5
    CVE-2026-24635

    WordPress EduBlink Core plugin <= 2.0.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DevsBlink EduBlink Core edublink-core allows PHP Local File Inclusion.This issue affects EduBlink Core: from n/a through <= 2.0.7.

    DevsBlink EduBlink Core
  • Medium 4.3
    CVE-2026-24636

    WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.

    Syed Balkhi Sugar Calendar (Lite)
  • Medium 5.3
    CVE-2026-24633

    WordPress Add Expires Headers & Optimized Minify plugin <= 3.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Expires Headers & Optimized Minify: from n/a thr…

    Passionate Brains Add Expires Headers & Optimized Minify
  • Medium 6.5
    CVE-2026-24630

    WordPress Stylish Cost Calculator plugin <= 8.2.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator allows Stored XSS.This issue affects Stylish Cost Calculator: from n/a through <= 8.2.9.

    Design Stylish Cost Calculator
  • Medium 5.4
    CVE-2026-24631

    WordPress Rosebud theme <= 1.4 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rosebud: from n/a through <= 1.4.

    Mikado-Themes Rosebud
  • Medium 5.9
    CVE-2026-24629

    WordPress Web Accessibility with Max Access plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ability, Inc Web Accessibility with Max Access accessibility-toolbar allows Stored XSS.This issue affects Web Accessibility with Max Access: from n/a through…

    Ability Web Accessibility with Max Access
  • Medium 5.3
    CVE-2026-24634

    WordPress Ultimate Reviews plugin <= 3.2.16 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Reviews: from n/a through <= 3.2.16.

    Rustaurius Ultimate Reviews
  • Medium 5.9
    CVE-2026-24632

    WordPress Delay Redirects plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jagdish1o1 Delay Redirects delay-redirects allows DOM-Based XSS.This issue affects Delay Redirects: from n/a through <= 1.0.0.

    jagdish1o1 Delay Redirects
  • High 7.6
    CVE-2026-24624

    WordPress Neoforum plugin <= 1.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in saeros1984 Neoforum neoforum allows Blind SQL Injection.This issue affects Neoforum: from n/a through <= 1.0.

    saeros1984 Neoforum
  • Medium 4.3
    CVE-2026-24627

    WordPress Trusona for WordPress plugin <= 2.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Trusona Trusona for WordPress trusona allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusona for WordPress: from n/a through <= 2.0.0.

    Trusona Trusona for WordPress Web / CMS
  • High 7.1
    CVE-2026-24623

    WordPress Neoforum plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in saeros1984 Neoforum neoforum allows Reflected XSS.This issue affects Neoforum: from n/a through <= 1.0.

    saeros1984 Neoforum
  • Medium 5.3
    CVE-2026-24625

    WordPress File Uploads Addon for WooCommerce plugin <= 1.7.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Imaginate Solutions File Uploads Addon for WooCommerce woo-addon-uploads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects File Uploads Addon for WooCommerce: from n/a through <= …

    Imaginate Solutions File Uploads Addon for WooCommerce Web / CMS
  • Medium 5.9
    CVE-2026-24626

    WordPress Logo Slider plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt Logo Slider logo-slider-wp allows Stored XSS.This issue affects Logo Slider: from n/a through <= 5.1.1.

    logichunt Logo Slider
  • Medium 5.9
    CVE-2026-24621

    WordPress Terms descriptions plugin <= 3.4.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows DOM-Based XSS.This issue affects Terms descriptions: from n/a through <= 3.4.9.

    Vladimir Statsenko Terms descriptions
  • Medium 5.9
    CVE-2026-24620

    WordPress Landing Page Builder plugin <= 1.5.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginOps Landing Page Builder page-builder-add allows Stored XSS.This issue affects Landing Page Builder: from n/a through <= 1.5.3.4.

    PluginOps Landing Page Builder
  • Medium 5.4
    CVE-2026-24622

    WordPress Suggestion Toolkit plugin <= 5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Sergiy Dzysyak Suggestion Toolkit suggestion-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Suggestion Toolkit: from n/a through <= 5.0.

    Sergiy Dzysyak Suggestion Toolkit
  • Medium 5.9
    CVE-2026-24614

    WordPress Flex QR Code Generator plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Devsbrain Flex QR Code Generator flex-qr-code-generator allows DOM-Based XSS.This issue affects Flex QR Code Generator: from n/a through <= 1.2.10.

    Devsbrain Flex QR Code Generator
  • Medium 6.5
    CVE-2026-24617

    WordPress Easy Modal plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Iser Easy Modal easy-modal allows Stored XSS.This issue affects Easy Modal: from n/a through <= 2.1.0.

    Daniel Iser Easy Modal
  • Medium 6.5
    CVE-2026-24616

    WordPress WP Popups plugin <= 2.2.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Damian WP Popups wp-popups-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Popups: from n/a through <= 2.2.0.5.

    Damian WP Popups
  • Medium 5.3
    CVE-2026-24619

    WordPress PopCash.Net Code Integration Tool plugin <= 1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PopCash PopCash.Net Code Integration Tool popcashnet-code-integration-tool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PopCash.Net Code Integration Tool: from n/a through <=…

    PopCash PopCash.Net Code Integration Tool
  • Medium 5.3
    CVE-2026-24615

    WordPress Cream Magazine theme <= 2.1.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themebeez Cream Magazine cream-magazine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Magazine: from n/a through <= 2.1.10.

    themebeez Cream Magazine
  • Medium 5.3
    CVE-2026-24612

    WordPress Orchid Store theme <= 1.5.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orchid Store: from n/a through <= 1.5.15.

    themebeez Orchid Store
  • Medium 5.3
    CVE-2026-24606

    WordPress Bayarcash WooCommerce plugin <= 4.3.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through <= 4.3.13.

    Web Impian Bayarcash WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-24607

    WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Monster: from n/a through <= 1.3.3.

    WP Travel Engine Travel Monster
  • High 7.5
    CVE-2026-24608

    WordPress Laurent Core plugin <= 2.4.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent Core laurent-core allows PHP Local File Inclusion.This issue affects Laurent Core: from n/a through <= 2.4.1.

    Elated-Themes Laurent Core
  • Medium 5.3
    CVE-2026-24613

    WordPress Ecwid Shopping Cart plugin <= 7.0.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ecwid Shopping Cart: from n/a through <= 7.0.…

    Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart
  • High 7.5
    CVE-2026-24609

    WordPress Laurent theme <= 3.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows PHP Local File Inclusion.This issue affects Laurent: from n/a through <= 3.1.

    Elated-Themes Laurent
  • Medium 5.3
    CVE-2026-24603

    WordPress Universal Google Adsense and Ads manager plugin <= 1.1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themebeez Universal Google Adsense and Ads manager universal-google-adsense-and-ads-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Google Adsense and Ads mana…

    themebeez Universal Google Adsense and Ads manager
  • Medium 4.3
    CVE-2026-24605

    WordPress X Addons for Elementor plugin <= 1.0.23 - Broken Access Control vulnerability

    Missing Authorization vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects X Addons for Elementor: from n/a through <= 1.0.23.

    pencilwp X Addons for Elementor
  • Medium 6.5
    CVE-2026-24601

    WordPress Penci Pay Writer plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Pay Writer penci-pay-writer allows Stored XSS.This issue affects Penci Pay Writer: from n/a through <= 1.5.

    PenciDesign Penci Pay Writer
  • Medium 5.3
    CVE-2026-24604

    WordPress Simple GDPR Cookie Compliance plugin <= 2.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple GDPR Cookie Compliance: from n/a through <= 2.0.0.

    themebeez Simple GDPR Cookie Compliance
  • Medium 5.3
    CVE-2026-24599

    WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.

    XLPlugins NextMove Lite
  • Medium 4.3
    CVE-2026-24596

    WordPress Related Posts Thumbnails plugin for WordPress plugin <= 4.3.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request Forgery.This issue affects Related Posts Thumbnails Plugin for WordPress: from n/a through <= 4.3.2.

    marynixie Related Posts Thumbnails Plugin for WordPress Web / CMS
  • Medium 6.5
    CVE-2026-24600

    WordPress Penci Review plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Review penci-review allows Stored XSS.This issue affects Penci Review: from n/a through <= 3.5.

    PenciDesign Penci Review
  • Medium 4.3
    CVE-2026-24598

    WordPress Multilanguage by BestWebSoft plugin <= 1.5.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bestwebsoft Multilanguage by BestWebSoft multilanguage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multilanguage by BestWebSoft: from n/a through <= 1.5.2.

    bestwebsoft Multilanguage by BestWebSoft
  • Medium 5.9
    CVE-2026-24594

    WordPress Livemesh Addons for WPBakery Page Builder plugin <= 3.9.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for WPBakery Page Builder addons-for-visual-composer allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder:…

    Livemesh Livemesh Addons for WPBakery Page Builder
  • Medium 5.4
    CVE-2026-24595

    WordPress Zoho CRM Lead Magnet plugin <= 1.8.1.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho CRM Lead Magnet: from n/a through <= 1.8.1.9.

    Zoho CRM Zoho CRM Lead Magnet
  • Medium 5.3
    CVE-2026-24593

    WordPress AWP Classifieds plugin <= 4.4.3 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Embedded Sensitive Data.This issue affects AWP Classifieds: from n/a through <= 4.…

    Strategy11 Team AWP Classifieds
  • Medium 6.5
    CVE-2026-24591

    WordPress Turn Yoast SEO FAQ Block to Accordion plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yasir129 Turn Yoast SEO FAQ Block to Accordion faq-schema-block-to-accordion allows Stored XSS.This issue affects Turn Yoast SEO FAQ Block to Accordion: from…

    yasir129 Turn Yoast SEO FAQ Block to Accordion