sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,545
Critical3,157
High11,924
Medium24,914
Reset
Showing 121-140 of 40545 records
Threat Entry Updated 2026-11-09

Profit Products Tables For Woocommerce - Security Vulnerability (CVE-2026-123183)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Code Injection.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.6.

PLUGIN Profit Products Tables For Woocommerce

CVE-2026-123183

MEDIUM CVSS 5.3 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Tour Booking Manager - Security Vulnerability (CVE-2026-120841)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

PLUGIN Tour Booking Manager

CVE-2026-120841

HIGH CVSS 8.8 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-121579)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Stored XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.

PLUGIN Unlimited Elements For Elementor

CVE-2026-121579

MEDIUM CVSS 6.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Tour Booking Manager - Security Vulnerability (CVE-2026-120839)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

PLUGIN Tour Booking Manager

CVE-2026-120839

HIGH CVSS 8.8 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Download Manager - Security Vulnerability (CVE-2026-119156)

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm_reg[first_name], wpdm_reg[last_name], wpdm_reg[user_login]' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have "Anyone can register" enabled, the plugin's [wpdm_reg_form] shortcode published on a public page, and at least one package authored by user ID 1 rendered with the…

PLUGIN Download Manager

CVE-2026-119156

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Profit Products Tables For Woocommerce - Security Vulnerability (CVE-2026-120579)

The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'help_title' parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Profit Products Tables For Woocommerce

CVE-2026-120579

MEDIUM CVSS 6.4 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Image Hover Effects Ultimate Visual Composer - Security Vulnerability (CVE-2026-109973)

The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers,…

PLUGIN Image Hover Effects Ultimate Visual Composer

CVE-2026-109973

MEDIUM CVSS 6.4 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Happyforms Upgrade - Security Vulnerability (CVE-2026-93766)

The Happyforms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'happyforms_client_referer' parameter in all versions up to, and including, 1.38.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Happyforms Upgrade

CVE-2026-93766

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Happyforms - Security Vulnerability (CVE-2026-93755)

The Happyforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spoofable client IP headers in versions up to, and including, 1.38.9. This is due to the happyforms_get_client_ip() function reading raw HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR request headers without any validation or sanitization, storing the value as post meta ('client_ip') via update_post_meta() during unauthenticated form submissions, and later echoing it in the admin submission edit screen's Details metabox without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user…

PLUGIN Happyforms

CVE-2026-93755

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Wp Members - Security Vulnerability (CVE-2026-96565)

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable via the WooCommerce classic checkout path, as the sibling registration, profile, and account-edit handlers implode the value before sanitization,…

PLUGIN Wp Members

CVE-2026-96565

MEDIUM CVSS 6.4 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

VikBooking Hotel Booking Engine & PMS - Security Vulnerability (CVE-2026-93429)

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'guests[][][documents]' Parameter in all versions up to, and including, 1.8.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to possess a valid booking sid/ts pair, which can be obtained by making a standard public booking, as the session token needed to satisfy the JSession::checkToken() gate…

PLUGIN VikBooking Hotel Booking Engine & PMS

CVE-2026-93429

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Church Admin - Security Vulnerability (CVE-2026-123418)

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lat' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when a Google Maps API key has been configured in Church Admin settings, as the vulnerable sink is only reached when that option is present.

PLUGIN Church Admin

CVE-2026-123418

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Ws Form - Security Vulnerability (CVE-2026-122231)

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field_[0][0]' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the client-side esc_html() helper returns any non-string value unchanged, allowing a nested-array payload coerced via Array.prototype.toString to reach jQuery .append() unescaped.

PLUGIN Ws Form

CVE-2026-122231

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.