sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 1581-1600 of 40783 records
Threat Entry Updated 2026-10-09

Acymailing - Security Vulnerability (CVE-2026-105318)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.

PLUGIN Acymailing

CVE-2026-105318

HIGH CVSS 7.1 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Envira Gallery Lite - Security Vulnerability (CVE-2026-104079)

Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.

PLUGIN Envira Gallery Lite

CVE-2026-104079

MEDIUM CVSS 5.3 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Livees Checkout - Security Vulnerability (CVE-2026-86851)

The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.

PLUGIN Livees Checkout

CVE-2026-86851

MEDIUM CVSS 6.5 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Shipping for Nova Poshta - Security Vulnerability (CVE-2026-87846)

The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.

PLUGIN Shipping for Nova Poshta

CVE-2026-87846

MEDIUM CVSS 5.3 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

GDPR Data Request Form - Security Vulnerability (CVE-2026-85348)

The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN GDPR Data Request Form

CVE-2026-85348

MEDIUM CVSS 4.3 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Restrict User Access - Security Vulnerability (CVE-2026-62040)

Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.

PLUGIN Restrict User Access

CVE-2026-62040

MEDIUM CVSS 5.3 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Super Payments - Security Vulnerability (CVE-2026-103329)

The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.

PLUGIN Super Payments

CVE-2026-103329

MEDIUM CVSS 5.3 2026-10-09
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.