sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total24,375
Critical0
High0
Medium24,375
Reset
Showing 1-20 of 24375 records
Threat Entry Updated 2026-10-12

Jet Elements - Security Vulnerability (CVE-2026-107866)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

PLUGIN Jet Elements

CVE-2026-107866

MEDIUM CVSS 6.5 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Woo Products Restricted Users - Security Vulnerability (CVE-2026-107863)

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.

PLUGIN Woo Products Restricted Users

CVE-2026-107863

MEDIUM CVSS 5.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Event Post - Security Vulnerability (CVE-2026-107427)

Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.

PLUGIN Event Post

CVE-2026-107427

MEDIUM CVSS 6.5 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Videowhisper Site Manager - Security Vulnerability (CVE-2026-107430)

Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.

PLUGIN Videowhisper Site Manager

CVE-2026-107430

MEDIUM CVSS 5.4 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Flexible Quantity Measurement Price Calculator For Woocommerce - Security Vulnerability (CVE-2026-106605)

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.

PLUGIN Flexible Quantity Measurement Price Calculator For Woocommerce

CVE-2026-106605

MEDIUM CVSS 5.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Hotel Booking - Security Vulnerability (CVE-2026-84167)

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

PLUGIN Hotel Booking

CVE-2026-84167

MEDIUM CVSS 4.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Hotel Booking - Security Vulnerability (CVE-2026-84166)

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.

PLUGIN Hotel Booking

CVE-2026-84166

MEDIUM CVSS 4.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

WP Comment Cleaner - Security Vulnerability (CVE-2026-107791)

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.

PLUGIN WP Comment Cleaner

CVE-2026-107791

MEDIUM CVSS 6.5 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

WP-Invoice - Security Vulnerability (CVE-2026-97183)

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.

PLUGIN WP-Invoice

CVE-2026-97183

MEDIUM CVSS 4.3 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

MemberHero - Security Vulnerability (CVE-2026-94235)

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.

PLUGIN MemberHero

CVE-2026-94235

MEDIUM CVSS 4.3 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Veeqo for WooCommerce - Security Vulnerability (CVE-2026-93550)

The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP files into the WordPress root.

PLUGIN Veeqo for WooCommerce

CVE-2026-93550

MEDIUM CVSS 4.3 2026-10-11
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.