Calgary, Alberta, Canada
sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total12,246
Critical0
High0
Medium12,246
Reset
Showing 541-560 of 12246 records
Threat Entry Updated 2026-06-17

CVE-2026-5149 - Rometheme For Elementor Plugin

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a user has permission to access the requested form submission data. This makes it possible for authenticated attackers, with Contributor-level access and above, to view arbitrary form submissions from other users by iterating the entries_id parameter.

PLUGIN Rometheme For Elementor

CVE-2026-5149

MEDIUM CVSS 6.5 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-9187 - Abandoned Contact Form 7 Plugin

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, which is registered to both the wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned hooks. The handler takes a user-supplied recover_id parameter from $_POST and passes it directly to wp_delete_post() with the force-delete flag set to true, without verifying that the ID belongs to the plugin's own cf7af_data post type. This makes it possible for unauthenticated attackers…

PLUGIN Abandoned Contact Form 7

CVE-2026-9187

MEDIUM CVSS 5.3 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-10780 - Static Block Plugin

The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_block_content() shortcode handler retrieving a post via get_post() using an attacker-supplied 'id' attribute and outputting its post_content without verifying the post's status (private, draft, pending) or the requesting user's capability to view it. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary posts, including private and draft static blocks (and any other post type) created…

PLUGIN Static Block

CVE-2026-10780

MEDIUM CVSS 4.3 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-6964 - Video Conferencing With Zoom Api Plugin

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain the site's Zoom SDK API key and a freshly-signed JWT that can be used with the Zoom Web SDK to join any Zoom meeting associated with those credentials without a legitimate invitation.

PLUGIN Video Conferencing With Zoom Api

CVE-2026-6964

MEDIUM CVSS 5.3 2026-06-16
Open Full Technical Breakdown
Scroll to top