sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 2061-2080 of 40783 records
Threat Entry Updated 2026-10-05

Booking - Security Vulnerability (CVE-2026-39601)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar booking allows Leveraging Race Conditions.This issue affects Booking Calendar: from n/a through 11.8.4.

PLUGIN Booking

CVE-2026-39601

LOW CVSS 3.7 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

JetAppointment - Security Vulnerability (CVE-2026-93875)

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the wp_jet_appointments_meta table via the unauthenticated jet_engine_form_booking_submit endpoint and executes in the administrator's browser when the appointment details popup is opened in the WordPress admin panel.

PLUGIN JetAppointment

CVE-2026-93875

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Divi Membership - Security Vulnerability (CVE-2026-19652)

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the `form_id` POST parameter, with no validation or whitelist of allowed roles. This makes it possible for unauthenticated attackers to register a new account with the administrator role by submitting a locally computed bcrypt hash of `administrator` as `form_id`, and when `auto_login=on` is submitted, be…

PLUGIN Divi Membership

CVE-2026-19652

CRITICAL CVSS 9.8 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Wp Statistics - Security Vulnerability (CVE-2026-97652)

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

PLUGIN Wp Statistics

CVE-2026-97652

MEDIUM CVSS 6.1 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

WPMobile.App - Security Vulnerability (CVE-2026-94541)

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the push queue by the mail-to-push feature, and use those URLs to take over the targeted accounts. This exploit chain requires the plugin's mail-to-push feature (wpmobile_auto_mail=1) to be enabled, as…

PLUGIN WPMobile.App

CVE-2026-94541

CRITICAL CVSS 9.8 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

W3 Total Cache - Security Vulnerability (CVE-2026-87920)

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the 'Remove query strings from static resources' option is enabled in W3 Total Cache, as mutate_url() must strip the '?' delimiter and everything following…

PLUGIN W3 Total Cache

CVE-2026-87920

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

All In One Seo Pack - Security Vulnerability (CVE-2026-85492)

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user visits a crafted URL. Exploitation requires the victim to hold the aioseo_manage_seo capability and to open the SEO Preview panel…

PLUGIN All In One Seo Pack

CVE-2026-85492

MEDIUM CVSS 6.1 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Customer Reviews Woocommerce - Security Vulnerability (CVE-2026-97663)

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the image attachment feature (ivole_attach_image) to be enabled, which allows unauthenticated attackers to both submit a review with an entity-encoded malicious author name and upload an attached image via the…

PLUGIN Customer Reviews Woocommerce

CVE-2026-97663

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Json Api Auth - Security Vulnerability (CVE-2026-97637)

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed solely by URI and query string, ignoring HTTP method and POST body; this causes the `generate_auth_cookie()` endpoint — which embeds a live WordPress `logged_in` cookie produced by `wp_generate_auth_cookie()` directly in its JSON response body — to serve that cached authenticated response to any subsequent unauthenticated GET request to the…

PLUGIN Json Api Auth

CVE-2026-97637

CRITICAL CVSS 9.8 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Relevanssi - A Better Search - Security Vulnerability (CVE-2026-97641)

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has configured a non-empty value for the "Allowable tags in excerpts" setting, such as the default example value of <p><a><strong>, as the prefix-matching regex must…

PLUGIN Relevanssi - A Better Search

CVE-2026-97641

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Jetformbuilder - Security Vulnerability (CVE-2026-97342)

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the…

PLUGIN Jetformbuilder

CVE-2026-97342

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Event Tickets - Security Vulnerability (CVE-2026-97634)

The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.29.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can reach the vulnerable code path by supplying a post_id…

PLUGIN Event Tickets

CVE-2026-97634

MEDIUM CVSS 6.5 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Download Manager - Security Vulnerability (CVE-2026-97338)

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the [wpdm_edit_profile] shortcode to be present on a front-end page accessible to Subscriber-level users, who can then submit a multiply entity-encoded payload via the display name field to…

PLUGIN Download Manager

CVE-2026-97338

MEDIUM CVSS 6.4 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Cmb2 - Security Vulnerability (CVE-2026-97336)

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an integrating plugin or theme registers a file_list field on a publicly accessible front-end form or a user meta box, as CMB2 is a developer library and does not expose…

PLUGIN Cmb2

CVE-2026-97336

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.