Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-5737

The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when the signature matches, combined with a scheduled favicon fetcher that performs unrestricted cURL requests to stored domains. The signature validation is insufficient because the signature is embedded in publicly-accessible JavaScript and the

PUBLISHED
Vendor
bensibley
Product
Independent Analytics – WordPress Analytics Plugin
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57369

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Builder themify-builder allows Reflected XSS.This issue affects Themify Builder: from n/a through <= 7.7.4.

PUBLISHED
Vendor
themifyme
Product
Themify Builder
Provider severity
HIGH
Conflicts
0

CVE-2026-57368

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.8.5.

PUBLISHED
Vendor
NooTheme
Product
Jobmonster
Provider severity
HIGH
Conflicts
0

CVE-2026-57367

Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

PUBLISHED
Vendor
WP Booking System .
Product
WP Booking System
Provider severity
HIGH
Conflicts
0

CVE-2026-57366

Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.

PUBLISHED
Vendor
Greg Winiarski
Product
WPAdverts
Provider severity
HIGH
Conflicts
0

CVE-2026-57365

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hitesh Chandwani reCAPTCHA (v2 &amp; v3) for Asgaros Forum recaptcha-for-asgaros-forum allows DOM-Based XSS.This issue affects reCAPTCHA (v2 &amp; v3) for Asgaros Forum: from n/a through <= 1.1.0.

PUBLISHED
Vendor
Hitesh Chandwani
Product
reCAPTCHA (v2 &amp; v3) for Asgaros Forum
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57364

Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More better-payment allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More: from n/a through <= 2.2.0.

PUBLISHED
Vendor
WPDeveloper
Product
Better Payment – Instant Payments, Donations, Fundraising with Subscriptions &amp; More
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57363

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatBot chatbot allows Stored XSS.This issue affects ChatBot: from n/a through <= 8.3.7.

PUBLISHED
Vendor
QuantumCloud
Product
ChatBot
Provider severity
HIGH
Conflicts
0

CVE-2026-57362

Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.

PUBLISHED
Vendor
QuantumCloud
Product
ChatBot
Provider severity
HIGH
Conflicts
0

CVE-2026-57361

Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.

PUBLISHED
Vendor
Ays Pro
Product
Survey Maker
Provider severity
HIGH
Conflicts
0

CVE-2026-57360

Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

PUBLISHED
Vendor
impleCode
Product
eCommerce Product Catalog
Provider severity
HIGH
Conflicts
0

CVE-2026-5736

A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of the argument customQuery leads to sql injection. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

PUBLISHED
Vendor
n/a
Product
PowerJob
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-57359

Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.

PUBLISHED
Vendor
ReviewX
Product
ReviewX
Provider severity
HIGH
Conflicts
0

CVE-2026-57358

Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

PUBLISHED
Vendor
SysBasics
Product
Customize My Account for WooCommerce
Provider severity
HIGH
Conflicts
0

CVE-2026-57357

Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

PUBLISHED
Vendor
Search Atlas Group
Product
Search Atlas SEO
Provider severity
HIGH
Conflicts
0

CVE-2026-57356

Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

PUBLISHED
Vendor
Moreconvert Team
Product
MC Woocommerce Wishlist
Provider severity
HIGH
Conflicts
0

CVE-2026-57355

Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

PUBLISHED
Vendor
RadiusTheme
Product
Classified Listing
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57354

Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

PUBLISHED
Vendor
Crocoblock. Jetimpex Inc.
Product
JetReviews
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57353

Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

PUBLISHED
Vendor
LinkWhisper
Product
Link Whisper Premium
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57352

Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.

PUBLISHED
Vendor
VillaTheme
Product
ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57351

Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

PUBLISHED
Vendor
Haktan Suren
Product
HandL UTM Grabber
Provider severity
HIGH
Conflicts
0

CVE-2026-57350

Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

PUBLISHED
Vendor
Andy Fragen
Product
WP Debugging
Provider severity
HIGH
Conflicts
0

CVE-2026-5735

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Mozilla, Red Hat, Red Hat, Red Hat, Mozilla
Product
Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Thunderbird, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Firefox
Provider severity
HIGH
Conflicts
3

CVE-2026-57349

Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

PUBLISHED
Vendor
etruel
Product
WPeMatico RSS Feed Fetcher
Provider severity
HIGH
Conflicts
0

CVE-2026-57348

Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.

PUBLISHED
Vendor
Cozmoslabs
Product
Paid Member Subscriptions
Provider severity
HIGH
Conflicts
0

CVE-2026-57347

Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.

PUBLISHED
Vendor
jetmonsters
Product
Hotel Booking Lite
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57346

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epiphyt Embed Privacy allows Path Traversal. This issue affects Embed Privacy: from n/a through 1.12.3.

PUBLISHED
Vendor
Epiphyt
Product
Embed Privacy
Provider severity
HIGH
Conflicts
0

CVE-2026-57345

Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

PUBLISHED
Vendor
Webraketen
Product
Internal Links Manager
Provider severity
HIGH
Conflicts
0

CVE-2026-57344

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

PUBLISHED
Vendor
RadiusTheme
Product
Classified Listing
Provider severity
HIGH
Conflicts
0

CVE-2026-57343

Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

PUBLISHED
Vendor
Contempoinc
Product
Real Estate 7
Provider severity
HIGH
Conflicts
0

CVE-2026-57342

Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.

PUBLISHED
Vendor
ShortPixel
Product
ShortPixel Adaptive Images
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57341

Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 versions.

PUBLISHED
Vendor
Colissimo
Product
Colissimo Officiel : Méthodes de livraison pour WooCommerce
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57340

Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.

PUBLISHED
Vendor
shohei.tanaka
Product
Japanized For WooCommerce
Provider severity
MEDIUM
Conflicts
0

CVE-2026-5734

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Mozilla, Red Hat, Red Hat, Red Hat, Red Hat, Mozilla, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Thunderbird, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 10.0 Extended Update Support, Firefox, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6
Provider severity
HIGH
Conflicts
3

CVE-2026-57339

Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions.

PUBLISHED
Vendor
Strategy11 Team
Product
Business Directory
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57338

Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

PUBLISHED
Vendor
Repute InfoSystems
Product
ARForms
Provider severity
HIGH
Conflicts
0

CVE-2026-57337

Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions.

PUBLISHED
Vendor
PluginOps
Product
Landing Page Builder
Provider severity
HIGH
Conflicts
0

CVE-2026-57336

Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions.

PUBLISHED
Vendor
Astoundify
Product
Jobify
Provider severity
HIGH
Conflicts
0

CVE-2026-57335

Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions.

PUBLISHED
Vendor
Ads WPQuads
Product
Ads by WPQuads
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57334

Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.

PUBLISHED
Vendor
weDevs
Product
WP User Frontend
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57333

Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions.

PUBLISHED
Vendor
Spencer Haws
Product
Link Whisper Free
Provider severity
HIGH
Conflicts
0

CVE-2026-57332

Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.

PUBLISHED
Vendor
WP Swings
Product
Wallet System for WooCommerce
Provider severity
HIGH
Conflicts
0

CVE-2026-57331

Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions.

PUBLISHED
Vendor
videowhisper
Product
Paid Videochat Turnkey Site
Provider severity
CRITICAL
Conflicts
0

CVE-2026-57330

Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.

PUBLISHED
Vendor
Stylemix
Product
MasterStudy LMS
Provider severity
MEDIUM
Conflicts
0

CVE-2026-5733

Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.

PUBLISHED
Vendor
Mozilla, Red Hat, Red Hat, Red Hat, Red Hat, Mozilla, Red Hat, Red Hat
Product
Firefox, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Thunderbird, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6
Provider severity
HIGH
Conflicts
2

CVE-2026-57329

Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions.

PUBLISHED
Vendor
WOOCOMMERCE DESIGNER PRO
Product
WooCommerce Designer Pro
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57328

Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.

PUBLISHED
Vendor
Strategy11 Team
Product
Business Directory
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57327

Subscriber Broken Access Control in MainWP <= 6.1.1 versions.

PUBLISHED
Vendor
mainwp
Product
MainWP
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57326

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions.

PUBLISHED
Vendor
Strategy11 Team
Product
Business Directory
Provider severity
MEDIUM
Conflicts
0

CVE-2026-57325

Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions.

PUBLISHED
Vendor
Jellywp
Product
NanoMag
Provider severity
HIGH
Conflicts
0