sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 921-940 of 40783 records
Threat Entry Updated 2026-10-30

Js Support Ticket - Security Vulnerability (CVE-2026-104739)

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a two-step sequence: an administrator first saves a traversal-crafted value in the support_custom_img configuration field,…

PLUGIN Js Support Ticket

CVE-2026-104739

MEDIUM CVSS 4.9 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-30

The Ad Inserter - Security Vulnerability (CVE-2026-102905)

The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires an administrator to have configured an ad block containing a dynamic tag such as {title}, {tag}, {category}, or {smart-tag} with display enabled on search pages, which is a…

PLUGIN The Ad Inserter

CVE-2026-102905

MEDIUM CVSS 6.5 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-30

Redux Framework - Security Vulnerability (CVE-2026-102918)

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can…

PLUGIN Redux Framework

CVE-2026-102918

MEDIUM CVSS 6.4 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-30

Media Player Addons For Elementor - Security Vulnerability (CVE-2026-119365)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10.

PLUGIN Media Player Addons For Elementor

CVE-2026-119365

MEDIUM CVSS 6.5 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-30

My Calendar - Security Vulnerability (CVE-2026-119714)

My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.

PLUGIN My Calendar

CVE-2026-119714

MEDIUM CVSS 6.9 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-30

The Events Calendar - Security Vulnerability (CVE-2026-119369)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.

PLUGIN The Events Calendar

CVE-2026-119369

MEDIUM CVSS 6.5 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-30

The Events Calendar - Security Vulnerability (CVE-2026-119370)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.

PLUGIN The Events Calendar

CVE-2026-119370

MEDIUM CVSS 6.5 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

Kirki - Security Vulnerability (CVE-2026-112348)

Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation.

PLUGIN Kirki

CVE-2026-112348

MEDIUM CVSS 6.9 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-30

Kirki - Security Vulnerability (CVE-2026-112347)

Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageController.php rely only on a coarse role-to-access middleware check without performing a per-object WordPress capability check. A user with Kirki edit access, granted to the Editor role by default, can exploit this flaw to modify the title, slug, and publication status of any non-trashed post of any post type, including custom post types and WooCommerce products they do not…

PLUGIN Kirki

CVE-2026-112347

HIGH CVSS 7.2 2026-10-30
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.