sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 1081-1100 of 40783 records
Threat Entry Updated 2026-10-26

Kadence Blocks - Security Vulnerability (CVE-2026-115602)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.

PLUGIN Kadence Blocks

CVE-2026-115602

MEDIUM CVSS 6.5 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

Bopo Woo Product Bundle Builder - Security Vulnerability (CVE-2026-110377)

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.

PLUGIN Bopo Woo Product Bundle Builder

CVE-2026-110377

MEDIUM CVSS 5.3 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-11-02

multi-segment data transfers where a malicious device can overflow memory buffers - Security Vulnerability (CVE-2026-82944)

SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data transfers where a malicious device can overflow memory buffers. The software checks the total size only once at the beginning, but doesn't track the cumulative size as multiple segments arrive. An attacker can declare a small initial size to pass validation, then send additional segments that exceed the allocated buffer. This allows the attacker to write controlled data beyond buffer boundaries, potentially enabling code execution.

PLUGIN multi-segment data transfers where a malicious device can overflow memory buffers

CVE-2026-82944

HIGH CVSS 8.8 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-11-02

WordPress component - Security Vulnerability (CVE-2026-82947)

SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes.

UNKNOWN WordPress component

CVE-2026-82947

HIGH CVSS 7.1 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

WordPress component - Security Vulnerability (CVE-2026-82946)

SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the master system. When the software receives an error response, it clears an internal pointer but continues processing. If another message arrives before timeout, the software attempts to use the cleared pointer, causing a crash. An attacker can trigger this with a simple sequence of two messages.

UNKNOWN WordPress component

CVE-2026-82946

MEDIUM CVSS 6.5 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

WordPress component - Security Vulnerability (CVE-2026-82945)

SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC_MAXFMMU entries. A device presenting more than EC_MAXFMMU configuration blocks can force writes beyond the array boundary, corrupting adjacent memory structures and potentially disrupting subsequent operations.

UNKNOWN WordPress component

CVE-2026-82945

MEDIUM CVSS 6.5 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

WordPress component - Security Vulnerability (CVE-2026-82943)

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.

UNKNOWN WordPress component

CVE-2026-82943

MEDIUM CVSS 6.5 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-11-02

WordPress component - Security Vulnerability (CVE-2026-70388)

SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device on the network can send specially crafted messages that cause the master to write data outside allocated memory boundaries. The software performs arithmetic on message length values without proper validation, allowing negative or extremely large values to bypass safety checks. This can corrupt memory and potentially allow an attacker to execute arbitrary code on the master system.

UNKNOWN WordPress component

CVE-2026-70388

HIGH CVSS 8.3 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

GiveWP - Security Vulnerability (CVE-2026-111974)

The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.

PLUGIN GiveWP

CVE-2026-111974

MEDIUM CVSS 5.3 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

Mintpay for WooCommerce - Security Vulnerability (CVE-2026-103381)

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.

PLUGIN Mintpay for WooCommerce

CVE-2026-103381

MEDIUM CVSS 6.5 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

OPay Payment Gateway for WooCommerce - Security Vulnerability (CVE-2026-103319)

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

PLUGIN OPay Payment Gateway for WooCommerce

CVE-2026-103319

MEDIUM CVSS 5.3 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

Online Payments with iK Pay Gateway - Security Vulnerability (CVE-2026-103306)

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

PLUGIN Online Payments with iK Pay Gateway

CVE-2026-103306

MEDIUM CVSS 5.3 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

Eurobank WooCommerce Payment Gateway - Security Vulnerability (CVE-2026-103300)

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default, allowing unauthenticated attackers to mark any pending order as paid, and to force any order into a failed status without any secret at all.

PLUGIN Eurobank WooCommerce Payment Gateway

CVE-2026-103300

MEDIUM CVSS 5.3 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-30

Payment Gateway - Security Vulnerability (CVE-2026-103299)

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

PLUGIN Payment Gateway

CVE-2026-103299

MEDIUM CVSS 5.3 2026-10-26
Open Full Technical Breakdown
Threat Entry Updated 2026-10-26

CCAvenue Payment Gateway for WooCommerce - Security Vulnerability (CVE-2026-103298)

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.

PLUGIN CCAvenue Payment Gateway for WooCommerce

CVE-2026-103298

MEDIUM CVSS 5.3 2026-10-26
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.