sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 1441-1460 of 40783 records
Threat Entry Updated 2026-10-10

Wpcom Member - Security Vulnerability (CVE-2026-104803)

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation in the session store, allowing an unauthenticated attacker to issue a crafted GET request that writes an attacker-named, attacker-valued entry into the global session namespace (bypassing the per-visitor prefix by prepending an underscore),…

PLUGIN Wpcom Member

CVE-2026-104803

CRITICAL CVSS 9.8 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-10

Wpo365 Login - Security Vulnerability (CVE-2026-104759)

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` — a 64-character hex value that `wp_verify_nonce()` can never successfully verify — causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have…

PLUGIN Wpo365 Login

CVE-2026-104759

HIGH CVSS 8.1 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-10

Print Invoices Packing Slip Labels For Woocommerce - Security Vulnerability (CVE-2026-93746)

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to…

PLUGIN Print Invoices Packing Slip Labels For Woocommerce

CVE-2026-93746

HIGH CVSS 7.5 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

Molongui Authorship - Security Vulnerability (CVE-2026-101920)

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment (href attribute inside comment content)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable in the free build because the plugin's author-filter rewriter never appends the ?m_bm=true marker to its…

PLUGIN Molongui Authorship

CVE-2026-101920

HIGH CVSS 7.2 2026-10-10
Open Full Technical Breakdown
Threat Entry Updated 2026-10-11

WPAdverts - Classifieds Plugin - Security Vulnerability (CVE-2026-100178)

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN WPAdverts - Classifieds Plugin

CVE-2026-100178

HIGH CVSS 7.2 2026-10-10
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.