sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 1421-1440 of 40783 records
Threat Entry Updated 2026-10-10

Divi Plus - Security Vulnerability (CVE-2026-91136)

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it…

PLUGIN Divi Plus

CVE-2026-91136

HIGH CVSS 7.5 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Peprodev Ups - Security Vulnerability (CVE-2026-4791)

The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Peprodev Ups

CVE-2026-4791

MEDIUM CVSS 6.4 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Hivepress - Security Vulnerability (CVE-2026-107657)

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern <a…

PLUGIN Hivepress

CVE-2026-107657

HIGH CVSS 7.2 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-10

Listdom - Security Vulnerability (CVE-2026-104722)

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

PLUGIN Listdom

CVE-2026-104722

MEDIUM CVSS 4.9 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-10

Appointment Booking Plugin - Security Vulnerability (CVE-2026-96662)

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN Appointment Booking Plugin

CVE-2026-96662

HIGH CVSS 7.5 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Wpo365 Login - Security Vulnerability (CVE-2026-96765)

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored in the wpo365_errors transient for up to three days by submitting a crafted unauthenticated request with a forged id_token whose base64url-decoded unique_name…

PLUGIN Wpo365 Login

CVE-2026-96765

HIGH CVSS 7.2 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Email Marketing for WordPress and WooCommerce - Security Vulnerability (CVE-2026-97396)

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Email Marketing for WordPress and WooCommerce

CVE-2026-97396

MEDIUM CVSS 6.4 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Avada - Security Vulnerability (CVE-2026-97340)

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and…

THEME Avada

CVE-2026-97340

MEDIUM CVSS 6.4 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Wp Photo Album Plus - Security Vulnerability (CVE-2026-96278)

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery('#wppa-modal-container').html() renders them.

PLUGIN Wp Photo Album Plus

CVE-2026-96278

HIGH CVSS 7.2 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-10

WP Directory Kit - Security Vulnerability (CVE-2026-96653)

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a display_name containing a single…

PLUGIN WP Directory Kit

CVE-2026-96653

MEDIUM CVSS 6.5 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Motors Car Dealership Classified Listings - Security Vulnerability (CVE-2026-96563)

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and…

PLUGIN Motors Car Dealership Classified Listings

CVE-2026-96563

MEDIUM CVSS 6.4 2026-10-10
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.