Calgary, Alberta, Canada
sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total4,286
Critical0
High4,286
Medium0
Reset
Showing 181-200 of 4286 records
Threat Entry Updated 2026-07-06

CVE-2026-14352 - Ar For Woocommerce Plugin

The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The three intended access controls all fail: valid nonces are freely minted by unauthenticated callers via the nopriv ar_get_fresh_nonce and ar_process_user_image AJAX handlers; the AES-256-CBC encryption key is derived from get_option('ar_licence_key'), which returns false on default free installations and yields a predictable key…

PLUGIN Ar For Woocommerce

CVE-2026-14352

HIGH CVSS 7.5 2026-07-03
Open Full Technical Breakdown
Threat Entry Updated 2026-07-07

CVE-2026-13040 - Nex Forms Express Wp Form Builder Plugin

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The submission endpoint is registered via wp_ajax_nopriv_submit_nex_form with no nonce verification, making it fully accessible to unauthenticated attackers without any CSRF token.

PLUGIN Nex Forms Express Wp Form Builder

CVE-2026-13040

HIGH CVSS 7.2 2026-07-03
Open Full Technical Breakdown
Threat Entry Updated 2026-07-06

CVE-2026-14327 - Ar For Wordpress Plugin

The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires an attacker to first obtain a valid nonce and secure nonce via the publicly accessible ar_get_fresh_nonce and ar_process_user_image nopriv AJAX handlers, and to reproduce the encryption key locally — both steps are fully achievable by an unauthenticated attacker on any default…

PLUGIN Ar For Wordpress

CVE-2026-14327

HIGH CVSS 7.5 2026-07-03
Open Full Technical Breakdown
Threat Entry Updated 2026-07-06

CVE-2026-7311 - Tiny Compress Images Plugin

The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, and including, 3.6.13. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can exploit this by injecting an arbitrary server file path into the 'convert.path' field of the…

PLUGIN Tiny Compress Images

CVE-2026-7311

HIGH CVSS 8.1 2026-07-02
Open Full Technical Breakdown
Scroll to top