Archive
20 August 2026
Vulnerabilities first published on this day (UTC), newest first.
495 results · Feed
-
Critical 9.6
WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery. This issue affects Easy Elementor Addons: from n/a through 2.3.7.
-
Critical 9.8
CVE-2026-18482
Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values int…
-
Medium 5.3
WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.
-
High 7.6
WordPress InfiniteWP Client plugin <= 1.13.9 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9.
-
Medium 4.8
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation.
-
Medium 6.6
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.
-
High 7.3
liftoff-sr CIPster Generic Attribute Logic ciptypes.h SetAttrData memory corruption
A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Perfo…
-
Medium 5.9
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior.
-
Low 2.3
Frozen BI aggregations leak host and service names to unauthorized users
Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are no…
-
Medium 5.0
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident respo…
-
Medium 5.4
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.
-
High 7.5
WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.
-
High 7.1
WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
-
Critical 9.9
WordPress Warehouse Cargo theme <= 2.6.9 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions.
-
Critical 9.9
WordPress Smart Cleaning theme <= 4.8.6 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.
-
Critical 9.9
WordPress IT Residence theme <= 3.2.1 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
-
High 8.5
WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
-
Critical 9.8
WordPress User Registration & Membership Pro plugin <= 5.4.5 - Account Takeover vulnerability
Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions.
-
High 8.5
WordPress WP w3all phpBB plugin <= 3.0.5 - SQL Injection vulnerability
Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.
-
Critical 9.8
WordPress FundEngine plugin <= 1.7.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
-
Critical 9.9
WordPress Query Wrangler plugin <= 1.5.57 - Remote Code Execution (RCE) vulnerability
Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions.
-
Critical 9.3
WordPress BookingPress Appointment Booking Pro plugin <= 6.0.2 - SQL Injection vulnerability
Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions.
-
Medium 6.5
WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
-
High 7.1
WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
-
Critical 9.3
WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
-
Critical 9.8
WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
-
High 7.6
WordPress Leyka plugin <= 3.32.3 - Broken Authentication vulnerability
Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
-
High 7.1
WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
-
Critical 9.8
WordPress Flatastic theme <= 2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
-
Critical 9.3
WordPress Directory Pro plugin <= 2.5.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
-
Medium 6.5
WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
-
High 7.1
WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.
-
High 7.1
WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
-
High 7.1
WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
-
High 7.1
WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
-
High 7.1
WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
-
Critical 9.3
WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
-
High 7.1
WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.
-
High 7.1
WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
-
High 7.1
WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.