Archive
6 August 2026
Vulnerabilities first published on this day (UTC), newest first.
493 results · Feed
-
Medium 5.3
WordPress Element Pack Elementor Addons plugin <= 8.7.13 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.
-
High 7.1
WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
-
High 7.1
WordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
-
High 7.1
WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
-
High 7.1
WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
-
Medium 6.5
WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
-
Medium 5.3
WordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.
-
High 7.2
WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
-
Medium 5.3
WordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerability
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.
-
Medium 5.3
WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions.
-
Medium 6.5
WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Powerkit <= 3.1.0 versions.
-
Medium 5.9
WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
-
High 7.1
WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Code Atlantic LLC Popup Maker popup-maker allows DOM-Based XSS.This issue affects Popup Maker: from n/a through 1.23.0.
-
Medium 5.3
WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
-
High 7.1
WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.
-
Medium 6.5
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability
Contributor Arbitrary File Download in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.14 versions.
-
High 7.1CVE-2026-28141 Scanner template
WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions.
-
High 7.1
WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
-
High 7.5
WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.
-
Critical 9.8
WordPress Ajax Search Lite plugin <= 4.14.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
-
High 8.8
WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability
Contributor Privilege Escalation in Forminator <= 1.56.0 versions.
-
High 7.1
WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions.
-
Critical 9.8
WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
-
Medium 6.5
WordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
-
High 7.5
WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
-
Critical 9.1CVE-2026-53976 Scanner template
OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query paramet…
-
Medium 4.3
RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass
The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber t…
-
Medium 5.3
LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection
A flaw has been found in LeeSinLiang godot-mcp 0.1.0. Affected by this vulnerability is the function executeOperation of the file src/index.ts of the component create_scene/add_node. This manipulation of the argument projectPath causes command injection. The …
-
Medium 5.9
LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descri…
-
Critical 9.8
OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec
OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn(…
-
Critical 9.1
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Informat…
-
Critical 9.8
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Inject…
-
Medium 6.8
Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A rem…
-
Critical 9.8
SQLi in Loca Software's CMS
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about …
-
Medium 6.3
MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection
A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to comman…
-
Medium 6.4
UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to …
-
Critical 9.6
In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfrest…
-
Medium 6.3
MissionSquad mcp-api dcrClients.ts server-side request forgery
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgradin…
-
High 8.3
Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout
OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authori…
-
Medium 4.3
Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard
OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traff…