sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 1201-1220 of 40783 records
Threat Entry Updated 2026-10-23

CleanTalk Anti-Spam – Complete Spam Protection - Security Vulnerability (CVE-2026-109198)

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the…

PLUGIN CleanTalk Anti-Spam – Complete Spam Protection

CVE-2026-109198

HIGH CVSS 7.2 2026-10-23
Open Full Technical Breakdown
Threat Entry Updated 2026-10-23

Backup - Security Vulnerability (CVE-2026-104068)

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.

PLUGIN Backup

CVE-2026-104068

HIGH CVSS 8.6 2026-10-22
Open Full Technical Breakdown
Threat Entry Updated 2026-10-23

Mang Board - Security Vulnerability (CVE-2026-109219)

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's default mode; the required nonce is printed on…

PLUGIN Mang Board

CVE-2026-109219

CRITICAL CVSS 9.8 2026-10-16
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Jet Elements - Security Vulnerability (CVE-2026-107866)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.

PLUGIN Jet Elements

CVE-2026-107866

MEDIUM CVSS 6.5 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Woo Products Restricted Users - Security Vulnerability (CVE-2026-107863)

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7.

PLUGIN Woo Products Restricted Users

CVE-2026-107863

MEDIUM CVSS 5.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Event Post - Security Vulnerability (CVE-2026-107427)

Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.

PLUGIN Event Post

CVE-2026-107427

MEDIUM CVSS 6.5 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Videowhisper Site Manager - Security Vulnerability (CVE-2026-107430)

Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through 1.2.10.

PLUGIN Videowhisper Site Manager

CVE-2026-107430

MEDIUM CVSS 5.4 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Flexible Quantity Measurement Price Calculator For Woocommerce - Security Vulnerability (CVE-2026-106605)

Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.

PLUGIN Flexible Quantity Measurement Price Calculator For Woocommerce

CVE-2026-106605

MEDIUM CVSS 5.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Hotel Booking - Security Vulnerability (CVE-2026-84167)

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

PLUGIN Hotel Booking

CVE-2026-84167

MEDIUM CVSS 4.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Hotel Booking - Security Vulnerability (CVE-2026-84166)

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.

PLUGIN Hotel Booking

CVE-2026-84166

MEDIUM CVSS 4.3 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

WP Comment Cleaner - Security Vulnerability (CVE-2026-107791)

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.

PLUGIN WP Comment Cleaner

CVE-2026-107791

MEDIUM CVSS 6.5 2026-10-12
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

WordPress component - Security Vulnerability (CVE-2026-108981)

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition. (The ngx_cache_purge module follows symlinks while walking the cache directory tree during purge operations. The module relies on nginx's ngx_walk_tree(), which relies on stat()…

UNKNOWN WordPress component

CVE-2026-108981

LOW CVSS 3.6 2026-10-12
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.