Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 410,174
- Last 24h
- 681
- Critical, 7 days
- 364
- Known exploited
- 1,779
26,207 results · Clear filters · Feed
-
Critical 9.8
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms Wo…
-
Critical 9.8
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plug…
-
Critical 9.8
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 …
-
Critical 9.1
Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure
The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store'…
-
Critical 9.8
Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE
The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary …
-
Critical 9.8
Wukong_HRM through commit 186115e Authentication Bypass via ParamAspect
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, s…
-
Critical 9.8
WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
-
Critical 9.8
WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
-
Critical 9.8
WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
-
Critical 9.8
WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
-
Critical 9.8
WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
-
Critical 9.8
WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
-
Critical 9.8
WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
-
Critical 9.8
WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
-
Critical 9.8
WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
-
Critical 9.8
WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
-
Critical 9.8
WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
-
Critical 9.8
WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
-
Critical 9.8
WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
-
Critical 9.9
WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
-
Critical 9.8
WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
-
Critical 9.8
WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
-
Critical 9.8
WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
-
Critical 9.8
WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
-
Critical 9.8
WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
-
Critical 9.8
WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
-
Critical 9.8
WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
-
Critical 9.8
WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
-
Critical 9.8
WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
-
Critical 9.8
WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
-
Critical 9.8
WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
-
Critical 9.8
WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
-
Critical 9.8
WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
-
Critical 9.8
WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
-
Critical 9.3
WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in uListing <= 2.2.0 versions.
-
Critical 9.8
WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Designinvento DirectoryPress directorypress allows PHP Local File Inclusion.This issue affects DirectoryPress: from n/a through 3.6.27.
-
Critical 9.9
WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
-
Critical 9.0
WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.
-
Critical 9.8
WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
-
Critical 9.8
WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.