Skip to content
OpenAdvisories

Latest vulnerabilities

Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.

Tracked
410,215
Last 24h
645
Critical, 7 days
362
Known exploited
1,779
All Critical High Medium Low Exploited only Public exploit

98,066 results · Clear filters · Feed

  • High 8.5
    CVE-2026-42416

    WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability

    Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

    AndonDesign UDesign Core
  • High 8.5
    CVE-2026-42414

    WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

    Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

    Cridio Studio ListingPro
  • High 7.5
    CVE-2026-42413

    WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

    DaftPlug Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate
  • High 7.5
    CVE-2026-41562

    WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

    norvisgabriel Norvis Backup
  • High 7.5
    CVE-2026-41561

    WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.

    Adrian Lin Museder RestoreOne
  • High 7.5
    CVE-2026-41560

    WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.

    wxdlabs WXD Backup Lite
  • High 7.5
    CVE-2026-41559

    WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup &amp; Restore <= 2.1.2 versions.

    Pluginjoy SafeSnap – Verified WordPress Backup &amp; Restore Web / CMS
  • High 7.1
    CVE-2026-40807

    WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

    Aman CF7 Views &#8211; Complete Entry Management for Contact Form 7
  • High 7.1
    CVE-2026-40806

    WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

    Plugin Devs Blog, Posts and Category Filter for Elementor
  • High 7.5
    CVE-2026-39796

    WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

    Flipper Code – WordPress Development Company Advanced Posts Listing – Show Post List Easily
  • High 7.5
    CVE-2026-39794

    WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.

    WC Lovers WooCommerce Multivendor Marketplace – REST API Web / CMS
  • High 8.8
    CVE-2026-39793

    WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

    Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

    Nicu Micle Simple JWT Login
  • High 8.6
    CVE-2026-39792

    WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

    Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.

    Mitchell Bennis Simple File List
  • High 7.1
    CVE-2026-39790

    WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.

    e4jvikwp VikRentCar
  • High 7.1
    CVE-2026-39781

    WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.

    Dan Rossiter Document Gallery
  • High 7.1
    CVE-2026-39784

    WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

    nicdark Hotel Booking
  • High 7.1
    CVE-2026-39780

    WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

    Youzify Youzify
  • High 7.1
    CVE-2026-39778

    WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.

    Themeansar Ansar Import – One Click Starter Sites – for Elementor &amp; Themes
  • High 8.0
    CVE-2026-39776

    WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

    Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

    wpshopmart Tabs
  • High 8.8
    CVE-2026-39774

    WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.

    Tourfic AI Studio Tourfic Pro
  • High 8.8
    CVE-2026-39775

    WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.

    DexignZone JobZilla - Job Board WordPress Theme Web / CMS
  • High 8.5
    CVE-2026-39771

    WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

    Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

    MightyNetworks vs BuddyBoss Buddyboss Platform
  • High 7.5
    CVE-2026-39769

    WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Password Recovery Exploitation.This issue affects Graphina – Charts and Graphs For …

    Iqonic Designs Graphina – Charts and Graphs For Elementor
  • High 7.1
    CVE-2026-39766

    WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

    Repute InfoSystems ARForms
  • High 7.2
    CVE-2026-39765

    WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

    Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.

    WebAppick Challan
  • High 7.1
    CVE-2026-39758

    WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.

    Midtrans Midtrans-WooCommerce Web / CMS
  • High 7.7
    CVE-2026-39752

    WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability

    Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.

    BlueGlass Interactive Jobs for WordPress Web / CMS
  • High 7.5
    CVE-2026-39751

    WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

    Payplug PayPlug for WooCommerce (Official) Web / CMS
  • High 7.1
    CVE-2026-39750

    WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

    wedevs StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart Web / CMS
  • High 7.1
    CVE-2026-39748

    WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

    ThemeMove EduMall
  • High 8.5
    CVE-2026-39747

    WordPress Woffice theme < 5.4.43 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WofficeIO Woffice woffice allows SQL Injection.This issue affects Woffice: from n/a before 5.4.43.

    WofficeIO Woffice
  • High 7.1
    CVE-2026-39745

    WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

    bestweblayout Contact Form to DB by BestWebSoft
  • High 7.1
    CVE-2026-39731

    WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

    code4life Database for CF7
  • High 7.1
    CVE-2026-39730

    WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

    Marcin Wise Chat
  • High 7.2
    CVE-2026-39729

    WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

    WisdmLabs Edwiser Bridge
  • High 7.2
    CVE-2026-39728

    WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability

    Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.

    instapagedev Instapage Plugin
  • High 7.1
    CVE-2026-39726

    WordPress Lumise Product Designer plugin < 2.1.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lumise Lumise Product Designer lumise allows Reflected XSS.This issue affects Lumise Product Designer: from n/a before 2.1.4.1.

    Lumise Lumise Product Designer
  • High 7.1
    CVE-2026-39724

    WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

    veppa HTTP Requests Manager
  • High 7.1
    CVE-2026-39720

    WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

    Mapster Technology Mapster WP Maps
  • High 7.1
    CVE-2026-39722

    WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

    VibeThemes WPLMS