sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,784
Critical3,170
High11,981
Medium25,054
Reset
Showing 2361-2380 of 40784 records
Threat Entry Updated 2026-10-07

If-So Dynamic Content Personalization - Security Vulnerability (CVE-2026-100507)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1.

PLUGIN If-So Dynamic Content Personalization

CVE-2026-100507

HIGH CVSS 7.1 2026-09-30
Open Full Technical Breakdown
Threat Entry Updated 2026-09-30

Product Designer App - Security Vulnerability (CVE-2026-75098)

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.

PLUGIN Product Designer App

CVE-2026-75098

HIGH CVSS 7.5 2026-09-30
Open Full Technical Breakdown
Threat Entry Updated 2026-09-30

Post Views Stats Counter - Security Vulnerability (CVE-2026-97347)

The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin's only input filter is a substring blacklist for known bot signatures (e.g. 'bot', 'spider', 'crawler'), which can be trivially bypassed by crafting a User-Agent payload that omits those strings.

PLUGIN Post Views Stats Counter

CVE-2026-97347

HIGH CVSS 7.2 2026-09-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-21

Real Estate Manager - Security Vulnerability (CVE-2026-93908)

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_price_text' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is further enabled by the absence of any capability, nonce, or ownership check on the wp_ajax_rem_create_pro_ajax handler, and because the…

PLUGIN Real Estate Manager

CVE-2026-93908

MEDIUM CVSS 6.4 2026-09-30
Open Full Technical Breakdown
Threat Entry Updated 2026-09-30

ReactPress - Create React App for - Security Vulnerability (CVE-2026-92712)

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body —…

PLUGIN ReactPress - Create React App for

CVE-2026-92712

MEDIUM CVSS 6.4 2026-09-30
Open Full Technical Breakdown
Threat Entry Updated 2026-09-30

Motors – Car Dealership & Classified Listings Plugin - Security Vulnerability (CVE-2026-6806)

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN Motors – Car Dealership & Classified Listings Plugin

CVE-2026-6806

HIGH CVSS 7.5 2026-09-30
Open Full Technical Breakdown
Threat Entry Updated 2026-09-30

Bold Page Builder - Security Vulnerability (CVE-2026-88037)

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Bold Page Builder

CVE-2026-88037

MEDIUM CVSS 6.4 2026-09-30
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.