Calgary, Alberta, Canada
sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total18,002
Critical1,249
High4,286
Medium12,246
Reset
Showing 581-600 of 18002 records
Threat Entry Updated 2026-07-02

CVE-2026-9834 - Wp Database Backup Plugin

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST['wp_db_exclude_table']` values into the `mysqldump` shell command string in the `mysqldump()` function of `includes/admin/class-wpdb-admin.php` without wrapping them in `escapeshellarg()`—every other argument in the same command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped, making the exclude-table values the sole exception—and because the only applied filtering, `sanitize_text_field()`…

PLUGIN Wp Database Backup

CVE-2026-9834

HIGH CVSS 7.2 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-13369 - Ninja Forms - File Uploads Plugin

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file_path value to reach wp_mail() as an email attachment with only a file_exists() check. This makes it possible for unauthenticated attackers to read arbitrary…

PLUGIN Ninja Forms - File Uploads

CVE-2026-13369

HIGH CVSS 7.5 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-8441 - Wp Review Slider Pro Plugin

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() — which strips HTML and whitespace but does not provide SQL safety. The value is then concatenated directly into a numeric/unquoted `AND id NOT IN (...)` clause and executed via $wpdb->get_results() without $wpdb->prepare() or intval() casting. Because the value sits in an unquoted numeric context, WordPress's wp_magic_quotes protection (which only escapes…

PLUGIN Wp Review Slider Pro

CVE-2026-8441

HIGH CVSS 7.5 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-14029 - And Marketing Automation Plugin

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versions up to, and including, 4.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to hold a Groundhogg custom role…

PLUGIN And Marketing Automation

CVE-2026-14029

MEDIUM CVSS 6.5 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-9145 - Contact Form Entries Plugin

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to Arbitrary File Copy via the create_entry_el() function in versions up to, and including, 1.5.1. The function reads raw_value from Elementor Pro's Form_Record object for upload-type fields and passes it directly to PHP's copy() without validating that the value corresponds to a legitimately uploaded file — when no file is present in $_FILES, raw_value reflects the attacker-controlled POST string. copy() accepts both local filesystem paths and URL sources, so the attacker can target any file readable…

PLUGIN Contact Form Entries

CVE-2026-9145

MEDIUM CVSS 6.5 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-13252 - Feedzy Rss Feeds Plugin

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Feedzy Rss Feeds

CVE-2026-13252

MEDIUM CVSS 6.4 2026-07-02
Open Full Technical Breakdown
Threat Entry Updated 2026-07-02

CVE-2026-13459 - Dynamic Blocks Form Builder Plugin

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta —…

PLUGIN Dynamic Blocks Form Builder

CVE-2026-13459

MEDIUM CVSS 5.3 2026-07-02
Open Full Technical Breakdown
Scroll to top