Calgary, Alberta, Canada
sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total4,286
Critical0
High4,286
Medium0
Reset
Showing 221-240 of 4286 records
Threat Entry Updated 2026-07-02

CVE-2026-9834 - Wp Database Backup Plugin

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST['wp_db_exclude_table']` values into the `mysqldump` shell command string in the `mysqldump()` function of `includes/admin/class-wpdb-admin.php` without wrapping them in `escapeshellarg()`—every other argument in the same command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped, making the exclude-table values the sole exception—and because the only applied filtering, `sanitize_text_field()`…

PLUGIN Wp Database Backup

CVE-2026-9834

HIGH CVSS 7.2 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-13369 - Ninja Forms - File Uploads Plugin

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file_path value to reach wp_mail() as an email attachment with only a file_exists() check. This makes it possible for unauthenticated attackers to read arbitrary…

PLUGIN Ninja Forms - File Uploads

CVE-2026-13369

HIGH CVSS 7.5 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-8441 - Wp Review Slider Pro Plugin

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() — which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeric/unquoted `AND id NOT IN (...)` clause and executed via $wpdb->get_results() without $wpdb->prepare() or intval() casting. Because the value sits in an unquoted numeric context, WordPress's wp_magic_quotes protection (which only escapes…

PLUGIN Wp Review Slider Pro

CVE-2026-8441

HIGH CVSS 7.5 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-13251 - Perfmatters Plugin

The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the Local Google Fonts feature to be enabled (disabled by default), pretty permalinks to be active, and RSS feed links to remain enabled in the plugin settings.

PLUGIN Perfmatters

CVE-2026-13251

HIGH CVSS 7.5 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-5821 - Image Optimization Plugin

The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. The plugin stores backup file paths in the image_optimizer_metadata post meta field and trusts these paths completely when deleting backups on the delete_attachment hook. An authenticated attacker with Author-level access can edit the image_optimizer_metadata post meta on…

PLUGIN Image Optimization

CVE-2026-5821

HIGH CVSS 8.1 2026-07-02
Open Full Technical Breakdown
Scroll to top