sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,545
Critical3,157
High11,924
Medium24,914
Reset
Showing 201-220 of 40545 records
Threat Entry Updated 2026-11-07

wpForo Forum - Security Vulnerability (CVE-2026-120532)

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post[body]' parameter in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN wpForo Forum

CVE-2026-120532

MEDIUM CVSS 6.4 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Zephyr Project Manager - Security Vulnerability (CVE-2026-120514)

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'zpm_profile_picture' parameter in all versions up to, and including, 3.3.209 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the subscriber's own Zephyr profile and fires in any Administrator's browser session the first time the autocomplete mention lookup renders the avatar…

PLUGIN Zephyr Project Manager

CVE-2026-120514

MEDIUM CVSS 5.4 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

Yml For Yandex Market - Security Vulnerability (CVE-2026-120548)

The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the 'y4ym_check_action' parameter. This makes it possible for unauthenticated attackers to extract the merchant's plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant's marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin…

PLUGIN Yml For Yandex Market

CVE-2026-120548

MEDIUM CVSS 5.3 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Ultimate Store Kit - Security Vulnerability (CVE-2026-119502)

Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 4.0.1.

PLUGIN Ultimate Store Kit

CVE-2026-119502

MEDIUM CVSS 5.3 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

wpForo Forum - Security Vulnerability (CVE-2026-119164)

The wpForo Forum plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.2 via the `data[secondary_groupids]` parameter of the `wpforo_action_profile_update` POST handler. This is due to a type-confusion flaw in the secondary_groupids authorization guard within the `Members::update()` function in `classes/Members.php`, where casting a scalar CSV string (e.g. `"0,1"`) with `(array)` before `array_map('intval', …)` and `array_filter()` produces an empty array — causing the guard's outer conditional, and the else-branch that would otherwise strip the field from the update, to be bypassed entirely — while `encode()`/`decode()`…

PLUGIN wpForo Forum

CVE-2026-119164

HIGH CVSS 7.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

wpForo Forum - Security Vulnerability (CVE-2026-119155)

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'href[locale]' parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required for exploitation is publicly issued to unauthenticated visitors on any forum page via the wpforo.nonces JavaScript object,…

PLUGIN wpForo Forum

CVE-2026-119155

HIGH CVSS 7.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Addon Elements For Elementor Page Builder - Security Vulnerability (CVE-2026-119465)

Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15.

PLUGIN Addon Elements For Elementor Page Builder

CVE-2026-119465

MEDIUM CVSS 5.3 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

Ameliabooking - Security Vulnerability (CVE-2026-107616)

The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information…

PLUGIN Ameliabooking

CVE-2026-107616

HIGH CVSS 7.5 2026-11-07
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.