sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,545
Critical3,157
High11,924
Medium24,914
Reset
Showing 101-120 of 40545 records
Threat Entry Updated 2026-11-10

Razorpay for WooCommerce - Security Vulnerability (CVE-2026-104338)

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an unauthenticated request parameter, allowing an unauthenticated attacker to cause the request to execute as an arbitrary user account for the duration of the request. Exploitation additionally requires a specific coupon Razorpay for WooCommerce WordPress plugin before 4.8.9 to be active on the site.

PLUGIN Razorpay for WooCommerce

CVE-2026-104338

LOW CVSS 3.7 2026-11-08
Open Full Technical Breakdown
Threat Entry Updated 2026-11-10

WordPress component - Security Vulnerability (CVE-2026-104307)

The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (Subscriber and above) to delete the BackUpWordPress plugin before 3.15's backup protection and working files, removing download protection from stored backups and disrupting in-progress backups.

UNKNOWN WordPress component

CVE-2026-104307

MEDIUM CVSS 5.4 2026-11-08
Open Full Technical Breakdown
Threat Entry Updated 2026-11-10

Razorpay for WooCommerce - Security Vulnerability (CVE-2026-104337)

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.

PLUGIN Razorpay for WooCommerce

CVE-2026-104337

MEDIUM CVSS 5.3 2026-11-08
Open Full Technical Breakdown
Threat Entry Updated 2026-11-10

Antom Payments - Security Vulnerability (CVE-2026-103375)

The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any customer's order details, including name, address, phone number and email.

PLUGIN Antom Payments

CVE-2026-103375

MEDIUM CVSS 5.3 2026-11-08
Open Full Technical Breakdown
Threat Entry Updated 2026-11-10

Turisbook Booking System - Security Vulnerability (CVE-2026-103303)

The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of them before outputting it in an admin page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators.

PLUGIN Turisbook Booking System

CVE-2026-103303

HIGH CVSS 8.8 2026-11-08
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

Subscribe2 - Security Vulnerability (CVE-2026-120531)

The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Subscribe2

CVE-2026-120531

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Meta Box - Security Vulnerability (CVE-2026-123472)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Stored XSS.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.

PLUGIN Meta Box

CVE-2026-123472

MEDIUM CVSS 6.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Meta Box - Security Vulnerability (CVE-2026-120836)

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.3.

PLUGIN Meta Box

CVE-2026-120836

MEDIUM CVSS 6.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Jet Form Builder Hierarchical Select - Security Vulnerability (CVE-2026-123861)

Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10.

PLUGIN Jet Form Builder Hierarchical Select

CVE-2026-123861

MEDIUM CVSS 5.3 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Premium Blocks For Gutenberg - Security Vulnerability (CVE-2026-123474)

Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18.

PLUGIN Premium Blocks For Gutenberg

CVE-2026-123474

MEDIUM CVSS 5.3 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Checkout Field Editor for WooCommerce - Security Vulnerability (CVE-2026-122041)

The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts)…

PLUGIN Checkout Field Editor for WooCommerce

CVE-2026-122041

CRITICAL CVSS 9.1 2026-11-07
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.