sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total3,064
Critical3,064
High0
Medium0
Reset
Showing 1-20 of 3064 records
Threat Entry Updated 2026-10-11

Insurify - Security Vulnerability (CVE-2026-86717)

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

PLUGIN Insurify

CVE-2026-86717

CRITICAL CVSS 9.1 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Quick quotes - Security Vulnerability (CVE-2026-86706)

The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.

PLUGIN Quick quotes

CVE-2026-86706

CRITICAL CVSS 9.1 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

erwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify - Security Vulnerability (CVE-2026-85121)

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.

PLUGIN erwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify

CVE-2026-85121

CRITICAL CVSS 9.1 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

AI Content Generator Marketing - Security Vulnerability (CVE-2026-85118)

The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.

PLUGIN AI Content Generator Marketing

CVE-2026-85118

CRITICAL CVSS 9.8 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Freeton WP - Security Vulnerability (CVE-2026-84737)

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.

PLUGIN Freeton WP

CVE-2026-84737

CRITICAL CVSS 9.8 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Mindstien Quick Login - Security Vulnerability (CVE-2026-84734)

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.

PLUGIN Mindstien Quick Login

CVE-2026-84734

CRITICAL CVSS 9.8 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

click5 CRM add-on to Contact Form 7 - Security Vulnerability (CVE-2026-84254)

The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

PLUGIN click5 CRM add-on to Contact Form 7

CVE-2026-84254

CRITICAL CVSS 9.8 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

click5 CRM add-on to Gravity Forms - Security Vulnerability (CVE-2026-84253)

The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

PLUGIN click5 CRM add-on to Gravity Forms

CVE-2026-84253

CRITICAL CVSS 9.8 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

click5 CRM add-on to WPForms - Security Vulnerability (CVE-2026-84252)

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

PLUGIN click5 CRM add-on to WPForms

CVE-2026-84252

CRITICAL CVSS 9.8 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

click5 CRM add-on to Ninja Forms - Security Vulnerability (CVE-2026-84251)

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

PLUGIN click5 CRM add-on to Ninja Forms

CVE-2026-84251

CRITICAL CVSS 9.8 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Fundiin cho WooCommerce - Security Vulnerability (CVE-2026-81649)

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores…

PLUGIN Fundiin cho WooCommerce

CVE-2026-81649

CRITICAL CVSS 9.1 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Anton Extensions - Security Vulnerability (CVE-2026-104028)

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

PLUGIN Anton Extensions

CVE-2026-104028

CRITICAL CVSS 9.8 2026-10-11
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.