sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 2221-2240 of 40783 records
Threat Entry Updated 2026-10-01

Ai Engine - Security Vulnerability (CVE-2026-96561)

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the PHP error-log parser (MeowKit_MWAI_Helpers::php_error_logs), the Advisor task (Meow_MWAI_Modules_Advisor::run_advisor), and the Advisor dashboard widget (advisor_metabox): the server-parameter denylist in chat_submit strips only exact key names such as 'model' while convert_keys() later canonicalizes 'model_' back to 'model', allowing an unauthenticated caller to place an attacker-controlled…

PLUGIN Ai Engine

CVE-2026-96561

HIGH CVSS 7.2 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Simply Schedule Appointments - Security Vulnerability (CVE-2026-92245)

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment public_token values. The leaked per-appointment public_token values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization.

PLUGIN Simply Schedule Appointments

CVE-2026-92245

HIGH CVSS 7.5 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-03

Simply Schedule Appointments - Security Vulnerability (CVE-2026-91109)

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose every co-booker's private per-appointment id_token (exposed as public_token) alongside their PII (name and email address), then use each leaked token to read, overwrite arbitrary appointment meta on, or cancel the co-booker's appointment via the same REST controller. Exploitation requires the attacker…

PLUGIN Simply Schedule Appointments

CVE-2026-91109

MEDIUM CVSS 6.5 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Newsletter - Security Vulnerability (CVE-2026-92537)

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route `/tnp/l/` is registered with `permission_callback => '__return_true'` and, upon receiving a valid keyed-MD5 signature, calls `set_user_cookie()`, which emits a `Set-Cookie: newsletter=-` response header to the requester because the subscriber object loaded via `get_user()` lacks the `_trusted` property, causing `get_user_key()` to return the raw token column value instead of its MD5-masked variant. This makes it possible for unauthenticated attackers who…

PLUGIN Newsletter

CVE-2026-92537

MEDIUM CVSS 5.3 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-09-30

Woo Vipps - Security Vulnerability (CVE-2026-97259)

Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.

PLUGIN Woo Vipps

CVE-2026-97259

MEDIUM CVSS 5.3 2026-09-30
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.