Calgary, Alberta, Canada
sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total18,002
Critical1,249
High4,286
Medium12,246
Reset
Showing 1021-1040 of 18002 records
Threat Entry Updated 2026-06-17

CVE-2026-9570 - Before 5 Plugin

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.

PLUGIN Before 5

CVE-2026-9570

HIGH CVSS 7.1 2026-06-17
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-8607 - Mycred Plugin

The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrap' Shortcode Attribute in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Mycred

CVE-2026-8607

MEDIUM CVSS 6.4 2026-06-17
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-8494 - Permalink Manager Plugin

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.

PLUGIN Permalink Manager

CVE-2026-8494

MEDIUM CVSS 6.4 2026-06-17
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-8383 - Before 4 Plugin

The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request

PLUGIN Before 4

CVE-2026-8383

MEDIUM CVSS 5.3 2026-06-17
Open Full Technical Breakdown
Scroll to top