Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.

Tracked
410,538
Last 24h
356
Critical, 7 days
303
Known exploited
1,781
All Critical High Medium Low Exploited only Public exploit

26,234 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-54812

    WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109.

    StylemixThemes Motors
  • Critical 9.6
    CVE-2026-55743

    OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution

    The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.

    tinyhumansai openhuman
  • Critical 9.3
    CVE-2026-54809

    WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue affects GIFT4U: from n/a through 1.0.10.

    villatheme GIFT4U
  • Critical 9.3
    CVE-2026-54808

    WordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Injection. This issue affects WP Travel Gutenberg Blocks: from n/a through 3.9.4.

    WP Travel WP Travel Gutenberg Blocks
  • Critical 9.8
    CVE-2025-60236

    WordPress Creatify theme <= 1.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5.

    EMV Creatify
  • Critical 9.8
    CVE-2025-60231

    WordPress The Hospital theme <= 1.8.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8.1.

    EMV The Hospital
  • Critical 9.3
    CVE-2026-54815

    WordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows Blind SQL Injection. This issue affects Cargo Shipping Location for WooCommerce: from n/a through 5.6.

    Cargo RD Cargo Shipping Location for WooCommerce Web / CMS
  • Critical 9.3
    CVE-2026-54819

    WordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection. This issue affects Listdom: from n/a through 5.4.0.

    Webilia Listdom
  • Critical 9.8
    CVE-2025-60230

    WordPress The Barber Shop theme <= 1.9 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9.

    Themeton The Barber Shop
  • Critical 9.8
    CVE-2025-60229

    WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0.

    Themeton Lagom
  • Critical 9.8
    CVE-2026-49108

    WordPress Moderno theme < 1.43 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

    park_of_ideas Moderno
  • Critical 9.8
    CVE-2025-69127

    WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

    ThemeREX Plumbing
  • Critical 9.8
    CVE-2025-69111

    WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

    ThemeREX Reisen
  • Critical 9.3
    CVE-2025-59554

    WordPress Advanced Ads – Tracking plugin < 3.0.7 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions.

    Advanced Ads Advanced Ads – Tracking
  • Critical 9.3
    CVE-2026-54811

    WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.

    Tips and Tricks HQ WP eMember
  • Critical 9.8
    CVE-2026-54807 Public exploit

    WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

    ThemeGrill Registration Form for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2026-54806 Public exploit

    WordPress WP Activity Log plugin <= 5.6.3.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

    melapress WP Activity Log
  • Critical 9.8
    CVE-2026-54803

    WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.

    Cozy Vision Technologies Pvt SMS Alert Order Notifications
  • Critical 9.3
    CVE-2026-54187

    WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability

    Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.

    Jetimpex JetEngine
  • Critical 9.3
    CVE-2026-54186

    WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability

    Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.

    EyeCix Technologies JobSearch
  • Critical 9.8
    CVE-2026-52706

    WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

    Jetimpex JetEngine
  • Critical 9.0
    CVE-2026-52705

    WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability

    Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.

    bdthemes SigmaForms Pro – AI Generated Forms
  • Critical 9.8
    CVE-2026-49767

    WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.

    Tomdever wpForo Forum
  • Critical 9.8
    CVE-2026-49107

    WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

    Thrive Themes Thrive Apprentice
  • Critical 9.3
    CVE-2026-49084

    WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability

    Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.

    Jetimpex JetEngine
  • Critical 9.3
    CVE-2026-49076

    WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.

    Crocoblock JetEngine
  • Critical 9.3
    CVE-2026-49079 Public exploit

    WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

    Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.

    Jetimpex JetSearch
  • Critical 9.8
    CVE-2026-49075

    WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

    Jetimpex JetEngine
  • Critical 9.8
    CVE-2026-49058

    WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions.

    LoginPress LoginPress Pro
  • Critical 9.3
    CVE-2026-48875

    WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability

    Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions.

    Jetimpex JetSmartFilters
  • Critical 9.8
    CVE-2026-42380

    WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

    jwsthemes AI Lab
  • Critical 9.9
    CVE-2026-40783

    WordPress Blocksy Companion Pro plugin <= 2.1.37 - Remote Code Execution (RCE) vulnerability

    Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.

    Creative Themes Blocksy Companion Pro
  • Critical 9.9
    CVE-2026-40749

    WordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerability

    Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.

    themagnifico52 Charity Zone
  • Critical 9.9
    CVE-2026-40748

    WordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerability

    Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.

    themagnifico52 Kids Gift Shop
  • Critical 9.9
    CVE-2026-40747

    WordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerability

    Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.

    themagnifico52 Ecommerce Zone
  • Critical 9.9
    CVE-2026-40746

    WordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability

    Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.

    themagnifico52 Restaurant Zone
  • Critical 9.8
    CVE-2026-40725

    WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

    Barn2 Media WooCommerce Product Filters Web / CMS
  • Critical 9.3
    CVE-2026-39596

    WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.

    Creative Themes Blocksy Companion Pro
  • Critical 9.9
    CVE-2026-39589

    WordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability

    Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.

    A WP Life Webenvo
  • Critical 9.9
    CVE-2026-27041

    WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability

    Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions.

    Studio Keren Aga Unlimited Elements for Elementor (Premium)