sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,545
Critical3,157
High11,924
Medium24,914
Reset
Showing 441-460 of 40545 records
Threat Entry Updated 2026-11-04

Simple Cloudflare Turnstile - Security Vulnerability (CVE-2026-93900)

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the shortcode attribute in the cfturnstile_gravity_shortcode() function: the value is filtered only by esc_html() and sanitize_text_field() (neither of which touches parentheses or dots) and then emitted via esc_js() in a raw JavaScript expression context outside any string literal (esc_js only escapes quotes, backslashes, and newlines). This makes it possible…

PLUGIN Simple Cloudflare Turnstile

CVE-2026-93900

MEDIUM CVSS 6.4 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Slim Jetpack - Security Vulnerability (CVE-2026-115498)

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce and authentication checks on form submission are only enforced for logged-in users, allowing unauthenticated visitors to store payloads via any page containing the [contact-form] shortcode.

PLUGIN Slim Jetpack

CVE-2026-115498

HIGH CVSS 7.2 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Doofinder For Woocommerce - Security Vulnerability (CVE-2026-56065)

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2.

PLUGIN Doofinder For Woocommerce

CVE-2026-56065

HIGH CVSS 7.5 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-62007)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.

PLUGIN Unlimited Elements For Elementor

CVE-2026-62007

HIGH CVSS 7.1 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Customer Area - Security Vulnerability (CVE-2026-57666)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.

PLUGIN Customer Area

CVE-2026-57666

HIGH CVSS 7.1 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Customer Area - Security Vulnerability (CVE-2026-54861)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.

PLUGIN Customer Area

CVE-2026-54861

HIGH CVSS 7.1 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Wpforms Lite - Security Vulnerability (CVE-2026-54851)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3.

PLUGIN Wpforms Lite

CVE-2026-54851

HIGH CVSS 7.1 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Stape Conversion Tracking - Security Vulnerability (CVE-2026-118422)

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.

PLUGIN Stape Conversion Tracking

CVE-2026-118422

HIGH CVSS 7.1 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

VikWidgetsLoader - Security Vulnerability (CVE-2026-118983)

The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.

PLUGIN VikWidgetsLoader

CVE-2026-118983

MEDIUM CVSS 6.8 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

All-in-One Video Gallery - Security Vulnerability (CVE-2026-118783)

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

PLUGIN All-in-One Video Gallery

CVE-2026-118783

MEDIUM CVSS 6.8 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Simple Download Monitor - Security Vulnerability (CVE-2026-118637)

The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.

PLUGIN Simple Download Monitor

CVE-2026-118637

LOW CVSS 2.7 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

WPvivid - Security Vulnerability (CVE-2026-115426)

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.

PLUGIN WPvivid

CVE-2026-115426

MEDIUM CVSS 5.5 2026-11-04
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Premium Packages - Security Vulnerability (CVE-2026-118407)

The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.

PLUGIN Premium Packages

CVE-2026-118407

MEDIUM CVSS 5.4 2026-11-04
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.