sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,545
Critical3,157
High11,924
Medium24,914
Reset
Showing 221-240 of 40545 records
Threat Entry Updated 2026-11-08

wpForo Forum - Security Vulnerability (CVE-2026-110004)

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This exploit chain is reachable only on sites where an administrator has created a custom wpForo secondary usergroup with a blank WordPress role and…

PLUGIN wpForo Forum

CVE-2026-110004

MEDIUM CVSS 6.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

Ameliabooking - Security Vulnerability (CVE-2026-104992)

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.9.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to export a full CSV of booking records for any event on the site — including attendee names, email addresses, phone numbers, booking status, number of persons, price, payment status, payment amount, and coupon codes…

PLUGIN Ameliabooking

CVE-2026-104992

MEDIUM CVSS 6.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Wpspeed - Security Vulnerability (CVE-2026-118784)

The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issues in the LightImages HTML optimizer: (1) Dispatcher::runOptimize() decides whether the current request is the site's home page by comparing only the URL path from REQUEST_URI against the path of the home URL, so on a plain-permalinks install the author archive URL /?author= is treated as the home page and the LightImages optimizer runs on it; and (2) LightImages::optimize() calls html_entity_decode() across the entire…

PLUGIN Wpspeed

CVE-2026-118784

MEDIUM CVSS 6.4 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

Wpjam Basic - Security Vulnerability (CVE-2026-103900)

The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the `role` key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to…

PLUGIN Wpjam Basic

CVE-2026-103900

HIGH CVSS 8.1 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Superb Blocks - Security Vulnerability (CVE-2026-66669)

Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.

PLUGIN Superb Blocks

CVE-2026-66669

HIGH CVSS 8.8 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Cf7 Post Fields - Security Vulnerability (CVE-2026-121768)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markus Wiesenhofer Contact Form 7 – Post Fields cf7-post-fields allows Stored XSS.This issue affects Contact Form 7 – Post Fields: from n/a through 2.6.0.

PLUGIN Cf7 Post Fields

CVE-2026-121768

MEDIUM CVSS 6.5 2026-11-07
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.