CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-57682

Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.

PUBLISHED

Vendor: QuantumCloud
Product: Simple Link Directory
Provider severity: HIGH
Conflicts: 0

CVE-2026-57681

Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.

PUBLISHED

Vendor: Paolo
Product: GeoDirectory
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57680

Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.

PUBLISHED

Vendor: Themeum
Product: Kirki
Provider severity: MEDIUM
Conflicts: 0

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functions, including starting/stopping activities, triggering vibrations, causing denial-of-service conditions, and fuzzing characteristic values to induce unexpected behavior. Additionally, the Frontier X mobile application lacks proper BLE device authentica

PUBLISHED

Vendor: Fourth Frontier, Fourth Frontier, Fourth Frontier
Product: Frontier X Android application, Frontier X IOS application, Frontier X2
Provider severity: HIGH
Conflicts: 1

CVE-2026-57679

Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.

PUBLISHED

Vendor: Ahmadgb
Product: GeekyBot
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-57678

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.

PUBLISHED

Vendor: ThemePunch
Product: Slider Revolution
Provider severity: HIGH
Conflicts: 0

CVE-2026-57677

Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.

PUBLISHED

Vendor: Novalnet
Product: Novalnet Payment Gateway for WooCommerce
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-57676

Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9.

PUBLISHED

Vendor: Matteo Manna
Product: Simple User Avatar
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57675

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.

PUBLISHED

Vendor: Jacob N. Breetvelt
Product: WP Photo Album Plus
Provider severity: HIGH
Conflicts: 0

CVE-2026-57674

Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.

PUBLISHED

Vendor: Arraytics
Product: Timetics
Provider severity: HIGH
Conflicts: 0

CVE-2026-57673

Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

PUBLISHED

Vendor: Optimole
Product: Optimole
Provider severity: HIGH
Conflicts: 0

CVE-2026-57672

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

PUBLISHED

Vendor: Melograno Venture Studio
Product: wpDataTables
Provider severity: HIGH
Conflicts: 0

CVE-2026-57671

Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.

PUBLISHED

Vendor: Perfmatters
Product: perfmatters
Provider severity: HIGH
Conflicts: 0

CVE-2026-57670

Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.

PUBLISHED

Vendor: Codepeople
Product: Google Maps CP
Provider severity: HIGH
Conflicts: 0

CVE-2026-5767

The SlideShowPro SC plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `slideShowProSC` shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PUBLISHED

Vendor: luetkemj
Product: SlideShowPro SC
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57669

Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

PUBLISHED

Vendor: Vsourz Digital
Product: Advanced Contact form 7 DB
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57668

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Stored XSS.This issue affects NEX-Forms: from n/a through <= 9.2.2.

PUBLISHED

Vendor: Basix
Product: NEX-Forms
Provider severity: HIGH
Conflicts: 0

CVE-2026-57667

Sales Representative SQL Injection in Groundhogg <= 4.5 versions.

PUBLISHED

Vendor: Adrian Tobey
Product: Groundhogg
Provider severity: HIGH
Conflicts: 0

CVE-2026-57665

Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.

PUBLISHED

Vendor: GravityKit
Product: GravityView
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57664

Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions.

PUBLISHED

Vendor: VillaTheme
Product: Bopo – WooCommerce Product Bundle Builder
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57663

Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.

PUBLISHED

Vendor: Igor Benic
Product: Recipe Maker For Your Food Blog from Zip Recipes
Provider severity: HIGH
Conflicts: 0

CVE-2026-57662

Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.

PUBLISHED

Vendor: Wasiliy Strecker
Product: Contest Gallery
Provider severity: HIGH
Conflicts: 0

CVE-2026-57661

Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.

PUBLISHED

Vendor: Nexcess
Product: WPComplete
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57660

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

PUBLISHED

Vendor: magepeopleteam
Product: Booking and Rental Manager
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5766

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-Length` header can bypass the `FILE_UPLOAD_MAX_MEMORY_SIZE` limit, potentially loading large files into memory and causing service degradation. As a reminder, Django expects a limit to be configured at the web server level rather than solely relying on `FILE_UPLOAD_MAX_MEMORY_SIZE`. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and

PUBLISHED

Vendor: djangoproject
Product: Django
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-57659

Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= 0.7.2 versions.

PUBLISHED

Vendor: Stranger Studios
Product: Paid Memberships Pro - Add Member From Admin
Provider severity: HIGH
Conflicts: 0

CVE-2026-57658

Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

PUBLISHED

Vendor: Templatespare
Product: TemplateSpare
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-57657

Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions.

PUBLISHED

Vendor: Noor Alam
Product: Gmail SMTP
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57656

Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.

PUBLISHED

Vendor: peregrinethemes
Product: Hester Core
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57655

Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.

PUBLISHED

Vendor: Jay Versluis
Product: Child Theme Wizard
Provider severity: HIGH
Conflicts: 0

CVE-2026-57654

Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

PUBLISHED

Vendor: wp.insider
Product: Affiliates Manager
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57653

Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.

PUBLISHED

Vendor: wpjobportal
Product: WP Job Portal
Provider severity: HIGH
Conflicts: 0

CVE-2026-57652

Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.

PUBLISHED

Vendor: JoomSky
Product: JS Help Desk
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57651

Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

PUBLISHED

Vendor: nK
Product: Ghost Kit
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57650

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.

PUBLISHED

Vendor: BlockArt
Product: Magazine Blocks
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57649

Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.

PUBLISHED

Vendor: studiowombat
Product: Shoppable Images Lite
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57648

Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.

PUBLISHED

Vendor: Nelio Software
Product: Nelio Content
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57647

Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.

PUBLISHED

Vendor: bPlugins
Product: Panorama Viewer – 360 Degree Image + Video Viewer
Provider severity: HIGH
Conflicts: 0

CVE-2026-57646

Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.

PUBLISHED

Vendor: Majestic Support
Product: Majestic Support
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57645

newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.

PUBLISHED

Vendor: Tribulant Software
Product: Newsletters
Provider severity: HIGH
Conflicts: 0

CVE-2026-57644

Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.

PUBLISHED

Vendor: jetmonsters
Product: Restaurant Menu by MotoPress
Provider severity: HIGH
Conflicts: 0

CVE-2026-57643

Contributor SQL Injection in WP Post Author <= 3.9.1 versions.

PUBLISHED

Vendor: AF themes
Product: WP Post Author
Provider severity: HIGH
Conflicts: 0

CVE-2026-57642

Contributor SQL Injection in Gallery <= 4.7.8 versions.

PUBLISHED

Vendor: bestwebsoft
Product: Gallery
Provider severity: HIGH
Conflicts: 0

CVE-2026-57641

Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.

PUBLISHED

Vendor: Contempoinc
Product: Real Estate 7
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57640

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.

PUBLISHED

Vendor: Stylemix
Product: MasterStudy LMS
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57638

Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.

PUBLISHED

Vendor: WPManageNinja LLC
Product: Fluent Booking
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57637

Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

PUBLISHED

Vendor: tychesoftwares
Product: Abandoned Cart Lite for WooCommerce
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57636

Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.

PUBLISHED

Vendor: Tomdever
Product: wpForo Forum
Provider severity: HIGH
Conflicts: 0

CVE-2026-57635

Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.

PUBLISHED

Vendor: FunnelKit
Product: FunnelKit Payment Gateway for Stripe WooCommerce
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-57634

Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.

PUBLISHED

Vendor: WP Folio Team
Product: PPWP
Provider severity: MEDIUM
Conflicts: 0