2026 CVEs (page 432)
Page 432 of 445 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24615 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Cream Magazine cream-magazine allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24614 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Devsbrain Flex QR Code Generator flex-qr-code-generator a… |
CVE-2026-24613 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Config… |
CVE-2026-24612 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-24609 | High | 7.5 | 2026-01-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows P… |
CVE-2026-24608 | High | 7.5 | 2026-01-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent Core laurent-cor… |
CVE-2026-24607 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-24606 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-24605 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-24604 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Co… |
CVE-2026-24603 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in themebeez Universal Google Adsense and Ads manager universal-google-adsense-and-ads-manager allows Exploiting Incorrectl… |
CVE-2026-24601 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Pay Writer penci-pay-writer allows Stor… |
CVE-2026-24600 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Review penci-review allows Stored XSS.T… |
CVE-2026-24599 | Medium | 5.3 | 2026-01-23 | Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Config… |
CVE-2026-24598 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in bestwebsoft Multilanguage by BestWebSoft multilanguage allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24596 | Medium | 4.3 | 2026-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request F… |
CVE-2026-24595 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-24594 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for WPBakery Page Builder addons… |
CVE-2026-24593 | Medium | 5.3 | 2026-01-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugi… |
CVE-2026-24591 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yasir129 Turn Yoast SEO FAQ Block to Accordion faq-schema… |
CVE-2026-24589 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in Cargus eCommerce Cargus cargus allows Retrieve Embedded Sensitive Data.This issue affects Ca… |
CVE-2026-24588 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in topdevs Smart Product Viewer smart-product-viewer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-24587 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in kutsy AJAX Hits Counter + Popular Posts Widget ajax-hits-counter allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-24585 | Medium | 6.5 | 2026-01-23 | Missing Authorization vulnerability in Hyyan Abo Fakher Hyyan WooCommerce Polylang Integration woo-poly-integration allows Exploiting Incorrectly Configured Ac… |
CVE-2026-24584 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS BunnyNet Integration tutor-lms-bunnynet… |
CVE-2026-24583 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configur… |
CVE-2026-24581 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce points-and-rewards-for-woocommerce allows Exploiting Incorrectly Configured… |
CVE-2026-24580 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shopping Cart ecwid-shopping-cart allows Exploiting Incorrectly Config… |
CVE-2026-24579 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configure… |
CVE-2026-24578 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Jahid Hasan Admin login URL Change admin-login-url-change allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24577 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Genetech Products Pie Register pie-register allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-24576 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in COP UX Flat ux-flat allows Stored XSS.This issue affects… |
CVE-2026-24572 | High | 8.5 | 2026-01-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind S… |
CVE-2026-24571 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in boxnow BOX NOW Delivery box-now-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-24570 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-24569 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Sully Media Library File Size media-library-file-size allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-24568 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24567 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in briarinc Anything Order by Terms anything-order-by-terms allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-24566 | Medium | 6.5 | 2026-01-23 | Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24565 | Medium | 6.5 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-24564 | Medium | 4.3 | 2026-01-23 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Israpil Textmetrics webtexttool allows Code Injection.This issue… |
CVE-2026-24563 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-24562 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Ryviu Ryviu – Product Reviews for WooCommerce ryviu allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-24561 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-24560 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in Cloudinary Cloudinary cloudinary-image-management-and-manipulation-in-the-cloud-cdn allows Exploiting Incorrectly Config… |
CVE-2026-24559 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Retrieve Embedded Sensit… |
CVE-2026-24558 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antoniobg ABG Rich Pins abg-rich-pins allows Stored XSS.T… |
CVE-2026-24557 | Medium | 5.3 | 2026-01-23 | Insertion of Sensitive Information Into Sent Data vulnerability in WEN Solutions Contact Form 7 GetResponse Extension contact-form-7-getresponse-extension allo… |
CVE-2026-24556 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-24555 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Stored… |
CVE-2026-24553 | Medium | 4.3 | 2026-01-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-… |
CVE-2026-24551 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in monetagwp Monetag Official Plugin monetag-official allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-24550 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaira Blockons blockons allows Stored XSS.This issue affe… |
CVE-2026-24549 | Medium | 4.3 | 2026-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in Paolo GeoDirectory geodirectory allows Cross Site Request Forgery.This issue affects GeoDirectory: from n/a… |
CVE-2026-24548 | Medium | 5.4 | 2026-01-23 | Server-Side Request Forgery (SSRF) vulnerability in princeahmed Radio Player radio-player allows Server Side Request Forgery.This issue affects Radio Player: f… |
CVE-2026-24544 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Harmonic Design HD Quiz hd-quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-24543 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-24542 | Medium | 4.3 | 2026-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Term Order wp-term-order allows Cross Site Request Forgery.This issue affects WP Term O… |
CVE-2026-24541 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-24540 | Medium | 5.4 | 2026-01-23 | Missing Authorization vulnerability in princeahmed Integrate Google Drive integrate-google-drive allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24539 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in ABCdatos Protección de datos – RGPD proteccion-datos-rgpd allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-24538 | High | 7.5 | 2026-01-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allo… |
CVE-2026-24536 | Medium | 5.3 | 2026-01-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve E… |
CVE-2026-24535 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in webdevstudios Automatic Featured Images from Videos automatic-featured-images-from-videos allows Exploiting Incorrectly… |
CVE-2026-24534 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in uPress Booter booter-bots-crawlers-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-24532 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configu… |
CVE-2026-24531 | High | 7.5 | 2026-01-23 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows P… |
CVE-2026-24530 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in sheepfish WebP Conversion webp-conversion allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-24529 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in Alejandro Quick Restaurant Reservations quick-restaurant-reservations allows Exploiting Incorrectly Configured Access Co… |
CVE-2026-24528 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks allows DOM-Based XSS.T… |
CVE-2026-24526 | Medium | 6.5 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Steve Truman Email Inquiry & Cart Options for WooCommerce… |
CVE-2026-24525 | Medium | 5.3 | 2026-01-23 | Missing Authorization vulnerability in CloudPanel CLP Varnish Cache clp-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-24524 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects T… |
CVE-2026-24523 | Medium | 5.3 | 2026-01-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retriev… |
CVE-2026-24522 | Medium | 4.3 | 2026-01-23 | Missing Authorization vulnerability in MyThemeShop WP Subscribe wp-subscribe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-24521 | Medium | 4.3 | 2026-01-23 | Cross-Site Request Forgery (CSRF) vulnerability in Timur Kamaev Kama Thumbnail kama-thumbnail allows Cross Site Request Forgery.This issue affects Kama Thumbna… |
CVE-2026-0994 | High | 7.5 | 2026-01-23 | A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when p… |
CVE-2026-0914 | Medium | 6.4 | 2026-01-23 | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lw_content_block' shortcode in all versions up to… |
CVE-2026-22276 | Medium | 5.5 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability… |
CVE-2026-22275 | Medium | 4.4 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Inclusion of Sensitive Information in Source Code vulne… |
CVE-2026-22274 | Medium | 6.5 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmission of Sensitive Information vulnerab… |
CVE-2026-22273 | High | 8.8 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Use of Default Credentials vulnerability in the OS. A l… |
CVE-2026-22271 | High | 7.5 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Transmission of Sensitive Information vulnerab… |
CVE-2026-1364 | Critical | 9.8 | 2026-01-23 | IAQS and I6 developed by JNC has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly operate system administrative fu… |
CVE-2026-1363 | Critical | 9.8 | 2026-01-23 | IAQS and I6 developed by JNC has a Client-Side Enforcement of Server-Side Security vulnerability, allowing unauthenticated remote attackers to gain administrat… |
CVE-2026-24515 | Low | 2.9 | 2026-01-23 | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. |
CVE-2026-0603 | High | 8.3 | 2026-01-23 | A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, u… |
CVE-2026-0927 | Medium | 5.3 | 2026-01-23 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the… |
CVE-2026-0796 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0795 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-0794 | Critical | 9.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter SIP Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe… |
CVE-2026-0793 | Critical | 9.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter InformaCast Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar… |
CVE-2026-0792 | Critical | 9.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter SIP INVITE Alert-Info Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… |
CVE-2026-0791 | Critical | 9.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter SIP INVITE Replaces Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e… |
CVE-2026-0790 | High | 7.5 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive informa… |
CVE-2026-0789 | High | 7.5 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure Vulnerability. This vulnerability allows remote at… |
CVE-2026-0788 | Medium | 6.1 | 2026-01-23 | ALGO 8180 IP Audio Alerter Web UI Persistent Cross-Site Scripting Vulnerability. This vulnerability allows remote attackers to execute web requests with a targ… |
CVE-2026-0787 | Critical | 9.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-0786 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter SCI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2026-0785 | High | 8.8 | 2026-01-23 | ALGO 8180 IP Audio Alerter API Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |