CVE Feed
- CVE-2026-107658 – BuddyForms <= 2.10.5 – Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion November 6, 2026
- CVE-2026-120035 – RSS Aggregator by Feedzy <= 5.2.13 – Unauthenticated Stored Cross-Site Scripting via Feed Item Title November 6, 2026
- CVE-2026-103908 – AMP for WP <= 1.1.18 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info November 6, 2026
- CVE-2026-116624 – Advanced Members for ACF <= 1.3.0 – Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form November 6, 2026
- CVE-2026-92895 – Live2DWebCanvas <= 2.2.1 – Unauthenticated Arbitrary File Upload via 'modelApi' Parameter November 6, 2026
- CVE-2026-119178 – Smart Cookie Kit <= 2.3.2 – Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration November 6, 2026
- CVE-2026-119211 – AAA Autoload Optimizer <= 1.7.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook November 6, 2026
- CVE-2026-116545 – All-in-One Video Gallery <= 5.0.0 – Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field November 6, 2026
- CVE-2026-107622 – BuddyForms <= 2.10.5 – Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter November 6, 2026
- CVE-2026-104010 – WPSyncSheets For Contact Form 7 <= 1.8.0 – Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize() November 6, 2026
- CVE-2026-116551 – WP Customer Area <= 8.4.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter November 6, 2026
- CVE-2026-114630 – ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 – Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter November 6, 2026
- CVE-2026-89101 – Everest Forms <= 3.6.2 – Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint November 6, 2026
- CVE-2026-103479 – Pubjet | پاب‌جت <= 5.4.8 – Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action November 6, 2026
- CVE-2026-84155 – Session Token Remains Valid After Logout in Multi-Worker Deployments November 6, 2026
- CVE-2026-84161 – Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics November 6, 2026
- CVE-2026-84164 – Stored XSS in the static HTML report export, because json.dumps does not escape the markup character November 6, 2026
- CVE-2026-66293 – XML comment injection in Saxy encoder via unescaped double hyphen November 6, 2026
- CVE-2026-66294 – XML injection in Saxy via unescaped CDATA section terminator November 6, 2026