CVE-2026-66xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

551 records · Page 3 of 6

• CVE-2026-66634: WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability 4.3 Medium

  Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

  Updated 2026-08-18
• CVE-2026-66633: WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

  Updated 2026-08-18
• CVE-2026-66632: WordPress Simple Cloudflare Turnstile plugin <= 1.42.1 - Content Injection vulnerability 6.5 Medium

  Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.

  Updated 2026-09-10
• CVE-2026-66631: WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.

  Updated 2026-09-17
• CVE-2026-66630: WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.

  Updated 2026-09-19
• CVE-2026-66629: WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

  Updated 2026-08-18
• CVE-2026-66628: WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability 7.6 High

  Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.

  Updated 2026-09-17
• CVE-2026-66627: WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5.

  Updated 2026-09-07
• CVE-2026-66626: WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability 7.6 High

  Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.

  Updated 2026-09-19
• CVE-2026-66625: WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.

  Updated 2026-09-17
• CVE-2026-66624: WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.

  Updated 2026-09-17
• CVE-2026-66623: WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.

  Updated 2026-08-24
• CVE-2026-66622: WordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability 7.5 High

  Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

  Updated 2026-08-18
• CVE-2026-66621: WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.

  Updated 2026-10-05
• CVE-2026-66620: WordPress OptionTree plugin <= 2.7.3 - PHP Object Injection vulnerability 7.2 High

  Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

  Updated 2026-08-18
• CVE-2026-66619: WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in Newsletters <= 4.18 versions.

  Updated 2026-09-19
• CVE-2026-66618: WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability 7.6 High

  Administrator SQL Injection in WP Maps <= 4.9.9 versions.

  Updated 2026-09-17
• CVE-2026-66617: WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.

  Updated 2026-09-19
• CVE-2026-66616: WordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.

  Updated 2026-10-06
• CVE-2026-66615: WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.

  Updated 2026-08-20
• CVE-2026-66614: WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.

  Updated 2026-08-20
• CVE-2026-66613: WordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability 9.8 Critical

  Unauthenticated Remote Code Execution (RCE) in JetEngine <= 3.8.14 versions.

  Updated 2026-08-20
• CVE-2026-66612: WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.

  Updated 2026-08-20
• CVE-2026-66611: WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.

  Updated 2026-08-20
• CVE-2026-66610: WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.

  Updated 2026-08-24
• CVE-2026-66609: WordPress TheGem (Elementor) theme <= 5.12.3 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.

  Updated 2026-08-20
• CVE-2026-66608: WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability 6.4 Medium

  Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.

  Updated 2026-09-17
• CVE-2026-66607: WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.

  Updated 2026-08-24
• CVE-2026-66606: WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

  Updated 2026-08-20
• CVE-2026-66605: WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.

  Updated 2026-08-20
• CVE-2026-66604: WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.

  Updated 2026-08-20
• CVE-2026-66603: WordPress Draft List plugin <= 2.6.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4.

  Updated 2026-08-19
• CVE-2026-66602: WordPress HashBar – WordPress Notification Bar plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability 8.8 High

  Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.

  Updated 2026-08-19
• CVE-2026-66601: WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.

  Updated 2026-08-20
• CVE-2026-66600: WordPress Media LIbrary Assistant plugin <= 3.39 - Arbitrary File Upload vulnerability 9.1 Critical

  Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.

  Updated 2026-08-20
• CVE-2026-66599: WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.

  Updated 2026-08-24
• CVE-2026-66598: WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.

  Updated 2026-08-20
• CVE-2026-66597: WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.

  Updated 2026-08-20
• CVE-2026-66596: WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Newsletter <= 9.3.3 versions.

  Updated 2026-08-19
• CVE-2026-66595: WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability 5.9 Medium

  Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.

  Updated 2026-08-20
• CVE-2026-66594: WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.

  Updated 2026-08-20
• CVE-2026-66593: WordPress Security & Malware scan by CleanTalk plugin <= 2.184 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.

  Updated 2026-08-20
• CVE-2026-66592: WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Blind SQL Injection.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.11.

  Updated 2026-10-26
• CVE-2026-66591: WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39.

  Updated 2026-08-21
• CVE-2026-66590: WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.

  Updated 2026-08-20
• CVE-2026-66589: WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30.

  Updated 2026-08-21
• CVE-2026-66588: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False-positive. Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False-positive.

  Updated 2026-10-13 · Rejected record
• CVE-2026-66587: WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability 9.8 Critical

  Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

  Updated 2026-08-24
• CVE-2026-66586: WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability 6.6 Medium

  Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

  Updated 2026-08-20
• CVE-2026-66585: WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability 7.5 High

  Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.

  Updated 2026-08-24
• CVE-2026-66584: WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.

  Updated 2026-08-24
• CVE-2026-66583: WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

  Updated 2026-08-20
• CVE-2026-66582: WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.

  Updated 2026-08-20
• CVE-2026-66581: WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.

  Updated 2026-08-20
• CVE-2026-66580: WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability 8.5 High

  Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.

  Updated 2026-09-17
• CVE-2026-66579: WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.

  Updated 2026-09-19
• CVE-2026-66578: WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.

  Updated 2026-09-17
• CVE-2026-66577: WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.

  Updated 2026-09-19
• CVE-2026-66576: WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.

  Updated 2026-09-17
• CVE-2026-66575: WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability 5.3 Medium

  Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.

  Updated 2026-09-17
• CVE-2026-66574: WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.

  Updated 2026-09-19
• CVE-2026-66573: WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.

  Updated 2026-09-17
• CVE-2026-66572: WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.

  Updated 2026-09-19
• CVE-2026-66571: WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.

  Updated 2026-09-17
• CVE-2026-66569: WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

  Updated 2026-10-11
• CVE-2026-66568: WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

  Updated 2026-10-11
• CVE-2026-66567: WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

  Updated 2026-10-11
• CVE-2026-66566: WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

  Updated 2026-10-11
• CVE-2026-66565: WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

  Updated 2026-10-11
• CVE-2026-66564: WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

  Updated 2026-10-11
• CVE-2026-66563: WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

  Updated 2026-10-11
• CVE-2026-66494: Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 8.7 High

  Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically..

  Updated 2026-08-10
• CVE-2026-66493: Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3 6.4 Medium

  Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.

  Updated 2026-08-10
• CVE-2026-66492: Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 6.1 Medium

  Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability.

  Updated 2026-08-10
• CVE-2026-66491: Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 8.2 High

  Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability.

  Updated 2026-08-10
• CVE-2026-66490: Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 6.1 Medium

  Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

  Updated 2026-08-12
• CVE-2026-66489: Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 5.3 Medium

  Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2

  Updated 2026-08-12
• CVE-2026-66488: Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2 5.3 Medium

  Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

  Updated 2026-08-12
• CVE-2026-66486: Improper Output Encoding in GNU cpio 4.6 Medium

  GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control se

  Updated 2026-08-10
• CVE-2026-66485: Uncontrolled Memory Allocation in GNU cpio 4.6 Medium

  GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow a

  Updated 2026-08-10
• CVE-2026-66484: Path Traversal in GNU cpio 4.6 Medium

  GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a

  Updated 2026-08-10
• CVE-2026-66483: WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

  Updated 2026-10-11
• CVE-2026-66482: WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

  Updated 2026-10-11
• CVE-2026-66481: WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability 6.8 Medium

  Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.

  Updated 2026-10-11
• CVE-2026-66480: WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.

  Updated 2026-10-11
• CVE-2026-66479: WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.

  Updated 2026-10-08
• CVE-2026-66478: WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.

  Updated 2026-08-13
• CVE-2026-66477: WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability 5.3 Medium

  Unauthenticated Broken Access Control in Gillion <= 4.13 versions.

  Updated 2026-07-27
• CVE-2026-66476: WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability 4.9 Medium

  Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.

  Updated 2026-07-27
• CVE-2026-66475: WordPress Checkout Field Editor for WooCommerce &#8211; Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce &#8211; Checkout Manager <= 3.0.5 versions.

  Updated 2026-07-27
• CVE-2026-66474: WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

  Updated 2026-07-27
• CVE-2026-66473: WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.

  Updated 2026-07-28
• CVE-2026-66472: WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability 9.3 Critical

  Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions.

  Updated 2026-08-13
• CVE-2026-66471: WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions.

  Updated 2026-08-13
• CVE-2026-66470: WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability 7.1 High

  Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.

  Updated 2026-08-06
• CVE-2026-66469: WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

  Updated 2026-08-13
• CVE-2026-66468: WordPress Local Delivery Drivers for WooCommerce plugin <= 3.0.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.

  Updated 2026-08-13
• CVE-2026-66467: WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

  Updated 2026-08-13
• CVE-2026-66466: WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability 7.5 High

  Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.

  Updated 2026-08-13
• CVE-2026-66465: WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability 9.8 Critical

  Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

  Updated 2026-08-13

Search a CVE ID or check dependency files →