sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total36,119
Critical2,650
High10,163
Medium22,841
Reset
Showing 1-20 of 36119 records
Threat Entry Updated 2026-10-12

Jet Elements - Security Vulnerability (CVE-2026-107866)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

PLUGIN Jet Elements

CVE-2026-107866

MEDIUM CVSS 6.5 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Woo Products Restricted Users - Security Vulnerability (CVE-2026-107863)

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.

PLUGIN Woo Products Restricted Users

CVE-2026-107863

MEDIUM CVSS 5.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Event Post - Security Vulnerability (CVE-2026-107427)

Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.

PLUGIN Event Post

CVE-2026-107427

MEDIUM CVSS 6.5 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Videowhisper Site Manager - Security Vulnerability (CVE-2026-107430)

Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.

PLUGIN Videowhisper Site Manager

CVE-2026-107430

MEDIUM CVSS 5.4 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Flexible Quantity Measurement Price Calculator For Woocommerce - Security Vulnerability (CVE-2026-106605)

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.

PLUGIN Flexible Quantity Measurement Price Calculator For Woocommerce

CVE-2026-106605

MEDIUM CVSS 5.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Hotel Booking - Security Vulnerability (CVE-2026-84167)

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

PLUGIN Hotel Booking

CVE-2026-84167

MEDIUM CVSS 4.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Hotel Booking - Security Vulnerability (CVE-2026-84166)

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.

PLUGIN Hotel Booking

CVE-2026-84166

MEDIUM CVSS 4.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

WP Comment Cleaner - Security Vulnerability (CVE-2026-107791)

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.

PLUGIN WP Comment Cleaner

CVE-2026-107791

MEDIUM CVSS 6.5 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Piotnet Forms - Security Vulnerability (CVE-2026-96227)

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).

PLUGIN Piotnet Forms

CVE-2026-96227

HIGH CVSS 8.8 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Subscribe to Comments - Security Vulnerability (CVE-2026-91829)

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators.

PLUGIN Subscribe to Comments

CVE-2026-91829

HIGH CVSS 7.1 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

WP-Invoice - Security Vulnerability (CVE-2026-97183)

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.

PLUGIN WP-Invoice

CVE-2026-97183

MEDIUM CVSS 4.3 2026-10-11
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.