sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 1281-1300 of 40783 records
Threat Entry Updated 2026-10-11

Envira Gallery - Security Vulnerability (CVE-2026-104682)

The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can edit an arbitrary post they name rather than that they are allowed to create the Envira Gallery WordPress plugin before 1.16.2's own gallery content, allowing users with contributor-level access to create and publish gallery posts that the Envira Gallery WordPress plugin before 1.16.2's settings otherwise withhold from them.

PLUGIN Envira Gallery

CVE-2026-104682

LOW CVSS 2.7 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Envira Gallery - Security Vulnerability (CVE-2026-104681)

The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.

PLUGIN Envira Gallery

CVE-2026-104681

LOW CVSS 2.7 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Prenotazioni - Security Vulnerability (CVE-2026-103305)

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.

PLUGIN Prenotazioni

CVE-2026-103305

HIGH CVSS 8.8 2026-10-11
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Dc Woocommerce Multi Vendor - Security Vulnerability (CVE-2026-108695)

MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings.

PLUGIN Dc Woocommerce Multi Vendor

CVE-2026-108695

HIGH CVSS 7.1 2026-10-11
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.