sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total175
Critical16
High53
Medium104
Reset
Showing 1-20 of 175 records
Threat Entry Updated 2026-11-06

WordPress Core - Security Vulnerability (CVE-2026-119977)

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability Vendor/Product: WordPress WordPress Core Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Notes: https://wordpress.org/news/2026/10/wordpress-7-1-4 ; https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution ; BOD 26-04:…

CORE WordPress Core

CVE-2026-119977

HIGH CVSS 8.1 2026-11-03
Open Full Technical Breakdown
Threat Entry Updated 2026-09-28

WordPress Core - Security Vulnerability (CVE-2026-87902)

WordPress Core Remote File Inclusion Vulnerability Vendor/Product: WordPress Core Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Notes: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements:…

CORE WordPress Core

CVE-2026-87902

HIGH CVSS 8.1 2026-09-25
Open Full Technical Breakdown
Threat Entry Updated 2026-09-19

WordPress Core - Security Vulnerability (CVE-2026-93485)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9…

CORE WordPress Core

CVE-2026-93485

HIGH CVSS 7.1 2026-09-18
Open Full Technical Breakdown
Threat Entry Updated 2026-07-24

WordPress Core - Security Vulnerability (CVE-2026-63030)

WordPress Core Interpretation Conflict Vulnerability Vendor/Product: WordPress Core Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ;…

CORE WordPress Core

CVE-2026-63030

CRITICAL CVSS 9.8 2026-07-21
Open Full Technical Breakdown
Threat Entry Updated 2026-08-04

WordPress Core - SQL Injection (CVE-2026-60137)

WordPress Core SQL Injection Vulnerability Vendor/Product: WordPress Core Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ;…

CORE WordPress Core

CVE-2026-60137

HIGH CVSS 5.9 2026-07-21
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2025-49043)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic_carousel allows Reflected XSS.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through

CORE WordPress Core

CVE-2025-49043

HIGH CVSS 7.1 2026-01-22
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Path Traversal (CVE-2025-22288)

Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through

CORE WordPress Core

CVE-2025-22288

MEDIUM CVSS 4.1 2025-11-06
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2025-58674)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user privileges to execute the attack vector.This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10,…

CORE WordPress Core

CVE-2025-58674

MEDIUM CVSS 5.9 2025-09-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Information Disclosure (CVE-2025-58246)

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it. This issue affects WordPress: from 6.8 through 6.8.2, from 6.7 through 6.7.3, from 6.6 through 6.6.3, from 6.5 through 6.5.6, from 6.4 through 6.4.6, from 6.3 through 6.3.6, from 6.2 through 6.2.7, from 6.1 through 6.1.8, from 6.0 through 6.0.10, from 5.9 through 5.9.11, from…

CORE WordPress Core

CVE-2025-58246

MEDIUM CVSS 4.3 2025-09-23
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2025-3704)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DBAR Productions Volunteer Sign Up Sheets pta-volunteer-sign-up-sheets allows Stored XSS.This issue affects Volunteer Sign Up Sheets: from n/a through < 5.5.5.

CORE WordPress Core

CVE-2025-3704

MEDIUM CVSS 5.9 2025-05-27
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Broken Access Control (CVE-2025-47556)

Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Compare Pricing Tables for WordPress: from n/a through

CORE WordPress Core

CVE-2025-47556

MEDIUM CVSS 5.4 2025-05-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2025-32520)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M. Ali Saleem WordPress Health and Server Condition – Integrated with Google Page Speed wp-condition allows Reflected XSS.This issue affects WordPress Health and Server Condition – Integrated with Google Page Speed: from n/a through

CORE WordPress Core

CVE-2025-32520

HIGH CVSS 7.1 2025-04-17
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.