Calgary, Alberta, Canada
sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total12,246
Critical0
High0
Medium12,246
Reset
Showing 281-300 of 12246 records
Threat Entry Updated 2026-07-02

CVE-2026-14029 - And Marketing Automation Plugin

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versions up to, and including, 4.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to hold a Groundhogg custom role…

PLUGIN And Marketing Automation

CVE-2026-14029

MEDIUM CVSS 6.5 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-9145 - Contact Form Entries Plugin

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from Elementor Pro's Form_Record object for upload-type fields and passes it directly to PHP's copy() without validating that the value corresponds to a legitimately uploaded file — when no file is present in $_FILES, raw_value reflects the attacker-controlled POST string. copy() accepts both local filesystem paths and URL sources, so the attacker can target any file readable…

PLUGIN Contact Form Entries

CVE-2026-9145

MEDIUM CVSS 6.5 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-13252 - Feedzy Rss Feeds Plugin

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Feedzy Rss Feeds

CVE-2026-13252

MEDIUM CVSS 6.4 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-13459 - Dynamic Blocks Form Builder Plugin

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta —…

PLUGIN Dynamic Blocks Form Builder

CVE-2026-13459

MEDIUM CVSS 5.3 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-9188 - Wappointment Plugin

The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.7.6 via the `appointmentkey` parameter due to the appointment `edit_key` — the sole authorization token consumed by `tryCancel()` — being generated as a predictable, unsalted MD5 hash of only `client_id` (a sequential integer), `start_at` (a publicly observable appointment timestamp), and `staff_id` (a small enumerable integer), with no secret salt or random component, and the unauthenticated cancellation and rescheduling REST endpoints performing no ownership…

PLUGIN Wappointment

CVE-2026-9188

MEDIUM CVSS 5.3 2026-07-02
Open Full Technical Breakdown
Scroll to top