2026 CVEs (page 338)
Page 338 of 452 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39572 | Medium | 4.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-… |
CVE-2026-39571 | Medium | 5.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Dat… |
CVE-2026-39570 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive… |
CVE-2026-39569 | Medium | 6.5 | 2026-04-08 | Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-39566 | Medium | 4.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedde… |
CVE-2026-39565 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-39564 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Retrieve Embedded Sensitive… |
CVE-2026-39563 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-39562 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-39561 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39544 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek LabtechCO labtechco allows P… |
CVE-2026-39543 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-39542 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensi… |
CVE-2026-39541 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Hydra Booking hydra-booking allows Stored XSS.Th… |
CVE-2026-39538 | High | 7.5 | 2026-04-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core… |
CVE-2026-39536 | Medium | 5.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Se… |
CVE-2026-39535 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-39528 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-39526 | Medium | 5.4 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-39521 | Medium | 4.9 | 2026-04-08 | Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content nelio-content allows Server Side Request Forgery.This issue affects Nelio Cont… |
CVE-2026-39520 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs… |
CVE-2026-39517 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.Th… |
CVE-2026-39516 | Medium | 5.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retr… |
CVE-2026-39510 | Low | 2.7 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting… |
CVE-2026-39509 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39508 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons ad… |
CVE-2026-39506 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-39505 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Con… |
CVE-2026-39504 | Medium | 5.4 | 2026-04-08 | Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-39501 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39500 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-add… |
CVE-2026-39497 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind… |
CVE-2026-39496 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.Th… |
CVE-2026-39495 | High | 8.5 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-app… |
CVE-2026-39488 | Medium | 6.5 | 2026-04-08 | Missing Authorization vulnerability in SureCart SureCart surecart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Su… |
CVE-2026-39487 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injec… |
CVE-2026-39486 | High | 8.5 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind S… |
CVE-2026-39485 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in embedplus Youtube Embed Plus youtube-embed-plus allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-39484 | Medium | 4.7 | 2026-04-08 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghos… |
CVE-2026-39483 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidekazu Ishikawa VK All in One Expansion Unit vk-all-in-… |
CVE-2026-39482 | Medium | 6.5 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Post Expirator post-expirator allows DOM-Bas… |
CVE-2026-39479 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL In… |
CVE-2026-39477 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-39476 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-39475 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind… |
CVE-2026-39473 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Pär Thernström Simple History simple-history allows Retrieve Embedded Sensitive Data.This is… |
CVE-2026-39469 | Medium | 4.3 | 2026-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve Embedded Sensitive… |
CVE-2026-39466 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Broken Link… |
CVE-2026-39464 | Medium | 5.5 | 2026-04-08 | Server-Side Request Forgery (SSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Server Side… |
CVE-2026-33088 | Critical | 9.8 | 2026-04-08 | Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement. |
CVE-2026-25776 | Critical | 9.8 | 2026-04-08 | Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script. |
CVE-2026-1396 | Medium | 6.4 | 2026-04-08 | The Magic Conversation For Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'magic-conversation' shortcode in all versio… |
CVE-2026-4655 | Medium | 6.4 | 2026-04-08 | The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG Image Widget in versions up to and includin… |
CVE-2026-4654 | Medium | 5.3 | 2026-04-08 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and includi… |
CVE-2026-4483 | | 2026-04-08 | An exposed IOCTL with an insufficient access control vulnerability has been identified in the utility, MxGeneralIo, for Moxa’s industrial x86 computers. The a… | |
CVE-2026-4330 | Medium | 4.3 | 2026-04-08 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up t… |
CVE-2026-5508 | Medium | 6.4 | 2026-04-08 | The WowPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wowpress` shortcode in all versions up to, and including, 1.0… |
CVE-2026-5506 | Medium | 6.4 | 2026-04-08 | The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wave` shortcode in all versions up to, and including, 0.2.6. This… |
CVE-2026-5169 | Medium | 4.4 | 2026-04-08 | The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Form Header' field in versions up to and includin… |
CVE-2026-5167 | Medium | 5.3 | 2026-04-08 | The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key… |
CVE-2026-4871 | Medium | 6.4 | 2026-04-08 | The Sports Club Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' attributes of the `scm_member_data` s… |
CVE-2026-4808 | High | 7.2 | 2026-04-08 | The Gerador de Certificados – DevApps plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the moveUploadedFile(… |
CVE-2026-4338 | High | 7.5 | 2026-04-08 | The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending… |
CVE-2026-4141 | Medium | 4.3 | 2026-04-08 | The Quran Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce… |
CVE-2026-3781 | Medium | 5.4 | 2026-04-08 | The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is… |
CVE-2026-3618 | Medium | 6.4 | 2026-04-08 | The Columns by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [print_clmns] shortcode in… |
CVE-2026-3594 | Medium | 5.3 | 2026-04-08 | The Riaxe Product Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4 via the '/wp-json/I… |
CVE-2026-3535 | Critical | 9.8 | 2026-04-08 | The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleF… |
CVE-2026-3480 | Medium | 6.5 | 2026-04-08 | The WP Blockade plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 0.9.14. The plugin registers an admin_post acti… |
CVE-2026-3477 | Medium | 5.3 | 2026-04-08 | The PZ Frontend Manager plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.6. The pzfm_user_request_action_cal… |
CVE-2026-3142 | Medium | 6.4 | 2026-04-08 | The Pinterest Site Verification plugin using Meta Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_var' parameter in version… |
CVE-2026-2838 | Medium | 4.4 | 2026-04-08 | The Whole Enquiry Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘woowhole_success_msg’ parameter in all versio… |
CVE-2026-5083 | Medium | 5.3 | 2026-04-08 | Ado::Sessions versions through 0.935 for Perl generates insecure session ids. The session id is generated from a SHA-1 hash seeded with the built-in rand func… |
CVE-2026-5082 | Medium | 5.3 | 2026-04-08 | Amon2::Plugin::Web::CSRFDefender versions from 7.00 through 7.03 for Perl generate an insecure session id. The generate_session_id function will attempt to re… |
CVE-2026-3311 | Medium | 6.4 | 2026-04-08 | The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Si… |
CVE-2026-33273 | High | 7.2 | 2026-04-08 | Unrestricted upload of file with dangerous type issue exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, an arbitrary file may be… |
CVE-2026-27787 | Medium | 5.4 | 2026-04-08 | Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web b… |
CVE-2026-24913 | High | 8.8 | 2026-04-08 | SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the database may be obtained… |
CVE-2026-4785 | Medium | 6.4 | 2026-04-08 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption'… |
CVE-2026-4341 | Medium | 6.4 | 2026-04-08 | The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'follow_us_text' setting of the Mount widget… |
CVE-2026-4333 | Medium | 6.4 | 2026-04-08 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses sho… |
CVE-2026-4299 | Medium | 5.3 | 2026-04-08 | The MainWP Child Reports plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.2.6. This is due to a missing capabi… |
CVE-2026-4003 | Critical | 9.8 | 2026-04-08 | The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15. Th… |
CVE-2026-3646 | Medium | 5.3 | 2026-04-08 | The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to Missing Authorization via the plugin's webhook handler in all versions up t… |
CVE-2026-3600 | Medium | 6.4 | 2026-04-08 | The Investi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'investi-announcements-accordion' shortcode's 'maximum-num-years' attribu… |
CVE-2026-3513 | Medium | 6.4 | 2026-04-08 | The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all vers… |
CVE-2026-3239 | Medium | 6.4 | 2026-04-08 | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonial_view shortcode in all versions up to, an… |
CVE-2026-4379 | Medium | 6.4 | 2026-04-08 | The LightPress Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `group` attribute in the `[gallery]` shortcode in all version… |
CVE-2026-2988 | Medium | 6.4 | 2026-04-08 | The Blubrry PowerPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'powerpress' and 'podcast' shortcodes in versions up to, and i… |
CVE-2026-5726 | High | 7.8 | 2026-04-08 | ASDA-Soft Stack-based Buffer Overflow Vulnerability |
CVE-2026-1163 | Medium | 4.1 | 2026-04-08 | An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a p… |
CVE-2026-3499 | High | 8.8 | 2026-04-08 | The Product Feed PRO for WooCommerce by AdTribes – Product Feeds for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1… |
CVE-2026-3296 | Critical | 9.8 | 2026-04-08 | The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input… |
CVE-2026-33810 | High | 8.2 | 2026-04-08 | When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different… |
CVE-2026-32289 | Medium | 6.1 | 2026-04-08 | Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used… |
CVE-2026-32288 | Medium | 5.5 | 2026-04-08 | tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "ol… |
CVE-2026-32283 | High | 7.5 | 2026-04-08 | If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consu… |
CVE-2026-32282 | Medium | 6.4 | 2026-04-08 | On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even… |
CVE-2026-32281 | High | 7.5 | 2026-04-08 | Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, pos… |
CVE-2026-32280 | High | 7.5 | 2026-04-08 | During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.In… |