Calgary, Alberta, Canada
sales@hackhalt.com
Free Download Free Download Free Download
Explore Pricing Explore Pricing Explore Pricing

Blog

"Prevention is cheaper than a breach"

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total18,002
Critical1,249
High4,286
Medium12,246
Reset
Showing 1181-1200 of 18002 records
Threat Entry Updated 2026-06-17

CVE-2026-49774 - RD Station Plugin

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.

PLUGIN RD Station

CVE-2026-49774

CRITICAL CVSS 9.9 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-49772 - The Events Calendar Plugin

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

PLUGIN The Events Calendar

CVE-2026-49772

CRITICAL CVSS 9.3 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-40809 - Metro Magazine Plugin

Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1.

PLUGIN Metro Magazine

CVE-2026-40809

MEDIUM CVSS 6.5 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-2381 - Woocommerce Gateway Stripe Plugin

The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order ownership or order_key verification when processing payment for an order via the `wc_stripe_pay_for_order` WC-AJAX endpoint. The function only validates a nonce (which is publicly available on any WooCommerce page where Express Checkout is enabled), but does not verify that the requesting user owns the target order and is allowed to…

PLUGIN Woocommerce Gateway Stripe

CVE-2026-2381

MEDIUM CVSS 6.5 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-8444 - Wp Review Slider Pro Plugin

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can…

PLUGIN Wp Review Slider Pro

CVE-2026-8444

HIGH CVSS 8.8 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-10093 - User Private Files Plugin

The File Sharing & Download Manager – User Private Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fldr_ttl' parameter in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN User Private Files

CVE-2026-10093

MEDIUM CVSS 6.4 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-8443 - Wp Review Slider Pro Plugin

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded array values are then concatenated directly into SQL WHERE clauses without parameterization, and the constructed query is executed via $wpdb->get_results() without $wpdb->prepare(). This makes it possible for authenticated attackers, with Subscriber-level access and…

PLUGIN Wp Review Slider Pro

CVE-2026-8443

HIGH CVSS 8.8 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-6933 - Premmerce Dev Tools Plugin

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' parameter directly into PHP stub files written to the wp-content/plugins/ directory. An attacker can inject a semicolon followed by arbitrary PHP code into the namespace parameter, causing the generated plugin file to contain and execute that code when accessed…

PLUGIN Premmerce Dev Tools

CVE-2026-6933

HIGH CVSS 8.8 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-5149 - Rometheme For Elementor Plugin

The RTMKit plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.7 This is due to the get_submission_content AJAX endpoint lacking a capability check to verify that a user has permission to access the requested form submission data. This makes it possible for authenticated attackers, with Contributor-level access and above, to view arbitrary form submissions from other users by iterating the entries_id parameter.

PLUGIN Rometheme For Elementor

CVE-2026-5149

MEDIUM CVSS 6.5 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-9187 - Abandoned Contact Form 7 Plugin

The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, which is registered to both the wp_ajax_remove_abandoned and wp_ajax_nopriv_remove_abandoned hooks. The handler takes a user-supplied recover_id parameter from $_POST and passes it directly to wp_delete_post() with the force-delete flag set to true, without verifying that the ID belongs to the plugin's own cf7af_data post type. This makes it possible for unauthenticated attackers…

PLUGIN Abandoned Contact Form 7

CVE-2026-9187

MEDIUM CVSS 5.3 2026-06-16
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

CVE-2026-10780 - Static Block Plugin

The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_block_content() shortcode handler retrieving a post via get_post() using an attacker-supplied 'id' attribute and outputting its post_content without verifying the post's status (private, draft, pending) or the requesting user's capability to view it. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary posts, including private and draft static blocks (and any other post type) created…

PLUGIN Static Block

CVE-2026-10780

MEDIUM CVSS 4.3 2026-06-16
Open Full Technical Breakdown
Scroll to top