sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 2121-2140 of 40783 records
Threat Entry Updated 2026-10-03

Autoptimize - Security Vulnerability (CVE-2026-78471)

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin,…

PLUGIN Autoptimize

CVE-2026-78471

MEDIUM CVSS 5.4 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Paytm Payment Gateway - Security Vulnerability (CVE-2026-81740)

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

PLUGIN Paytm Payment Gateway

CVE-2026-81740

MEDIUM CVSS 5.3 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Popup Maker - Security Vulnerability (CVE-2026-85004)

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option (the linked service account and API configuration) that should only be modifiable by administrators.

PLUGIN Popup Maker

CVE-2026-85004

MEDIUM CVSS 4.3 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Super Forms – Drag & Drop Form Builder - Security Vulnerability (CVE-2026-15896)

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory…

PLUGIN Super Forms – Drag & Drop Form Builder

CVE-2026-15896

CRITICAL CVSS 9.1 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Tabs Responsive - Security Vulnerability (CVE-2026-13718)

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

PLUGIN Tabs Responsive

CVE-2026-13718

MEDIUM CVSS 6.8 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Divi Membership - Security Vulnerability (CVE-2026-19660)

The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN validation, no cryptographic signature check, no ownership verification, and no nonce, allowing it to trust an entirely attacker-controlled user ID value that is passed directly to `wp_set_current_user()` and `wp_set_auth_cookie()`. This makes it possible for unauthenticated attackers to log in as any existing WordPress user — including administrators — by supplying an arbitrary user ID…

PLUGIN Divi Membership

CVE-2026-19660

CRITICAL CVSS 9.8 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

CTX Feed Pro - Security Vulnerability (CVE-2026-10026)

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server.

PLUGIN CTX Feed Pro

CVE-2026-10026

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Visitor Traffic Real Time Statistics pro - Security Vulnerability (CVE-2026-93367)

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the page_title parameter of the ahcpro_track_visitor AJAX action. The action is registered for logged-out callers (wp_ajax_nopriv_ahcpro_track_visitor) and stores $_POST['page_title'] with NO sanitization, keeping it raw in the ahc_title_traffic.til_page_title column. When an administrator opens the plugin's dashboard, the 'Traffic by Title' DataTable renders that stored value as innerHTML without output escaping, executing arbitrary JavaScript. This makes it possible for unauthenticated attackers to inject web scripts…

PLUGIN Visitor Traffic Real Time Statistics pro

CVE-2026-93367

HIGH CVSS 7.2 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

DevKit Pro - Security Vulnerability (CVE-2026-14378)

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_user_id` cookie as the privileged identity: `verify_nonce_and_capability()` incorrectly checks the `manage_options` capability on the user identified by the cookie rather than on the actual requester via `current_user_can()`, while the switch-back form and a valid session-bound nonce are emitted publicly via `wp_footer` to any visitor — including unauthenticated users — whenever that cookie is present. This makes…

PLUGIN DevKit Pro

CVE-2026-14378

CRITICAL CVSS 9.8 2026-10-02
Open Full Technical Breakdown
Threat Entry Updated 2026-10-07

WordPress component - Security Vulnerability (CVE-2026-82358)

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server implementation 'src/co_sdo_server.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload for a read-only Object Dictionary (OD) entry, which sets a data pointer to the read-only object, then send download-segment frames to write to that memory location. The download-segment handler does not verify that a download session is active, allowing any CANopen node to overwrite read-only OD entries using two…

UNKNOWN WordPress component

CVE-2026-82358

HIGH CVSS 7.1 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-07

WordPress component - Security Vulnerability (CVE-2026-82357)

RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1.

UNKNOWN WordPress component

CVE-2026-82357

HIGH CVSS 7.1 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Prime Mover - Security Vulnerability (CVE-2026-101888)

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemCheckUtilities.php to write attacker-controlled content to arbitrary filesystem locations, potentially achieving remote code execution if the written files are interpreted by the web environment.

PLUGIN Prime Mover

CVE-2026-101888

HIGH CVSS 8.6 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Prime Mover - Security Vulnerability (CVE-2026-101889)

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tar_root_folder values in wprime-config.json. Attackers can exploit insufficient path validation in computeExtractVariables() and validateImportedSiteVsPackage() to cause primeMoverDoDelete() to remove directories outside the intended extraction path, potentially deleting critical WordPress directories such as wp-admin and rendering the site inoperable.

PLUGIN Prime Mover

CVE-2026-101889

HIGH CVSS 7.0 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-02

Prime Mover - Security Vulnerability (CVE-2026-101890)

The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package.

PLUGIN Prime Mover

CVE-2026-101890

MEDIUM CVSS 5.1 2026-10-01
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.