sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 1641-1660 of 40783 records
Threat Entry Updated 2026-10-09

Kubio - Security Vulnerability (CVE-2026-94167)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.

PLUGIN Kubio

CVE-2026-94167

HIGH CVSS 7.1 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-11-10

Us Core - Security Vulnerability (CVE-2026-94166)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a before 9.4.1.

PLUGIN Us Core

CVE-2026-94166

HIGH CVSS 7.1 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Traveler - Security Vulnerability (CVE-2026-93947)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.

THEME Traveler

CVE-2026-93947

CRITICAL CVSS 9.3 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Jet Blocks - Security Vulnerability (CVE-2026-62049)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.

PLUGIN Jet Blocks

CVE-2026-62049

MEDIUM CVSS 6.5 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Kirki - Security Vulnerability (CVE-2026-84224)

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.

PLUGIN Kirki

CVE-2026-84224

MEDIUM CVSS 4.1 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Kirki - Security Vulnerability (CVE-2026-84220)

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.

PLUGIN Kirki

CVE-2026-84220

MEDIUM CVSS 4.8 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales - Security Vulnerability (CVE-2026-93548)

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.

PLUGIN authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales

CVE-2026-93548

HIGH CVSS 8.8 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

SendPress Newsletters - Security Vulnerability (CVE-2026-92990)

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.

PLUGIN SendPress Newsletters

CVE-2026-92990

MEDIUM CVSS 5.3 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

SendPress Newsletters - Security Vulnerability (CVE-2026-92989)

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.

PLUGIN SendPress Newsletters

CVE-2026-92989

MEDIUM CVSS 4.3 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Ocean Pro Demos and Ocean eComm Treasure Box - Security Vulnerability (CVE-2026-81929)

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display. A valid premium license, the Popup Builder…

PLUGIN Ocean Pro Demos and Ocean eComm Treasure Box

CVE-2026-81929

HIGH CVSS 7.2 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

SKU Error Fixer for WooCommerce - Security Vulnerability (CVE-2026-86850)

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.

PLUGIN SKU Error Fixer for WooCommerce

CVE-2026-86850

MEDIUM CVSS 6.5 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Social Web Suite - Security Vulnerability (CVE-2026-88931)

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.

PLUGIN Social Web Suite

CVE-2026-88931

MEDIUM CVSS 5.3 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

UnitechPay - Security Vulnerability (CVE-2026-87841)

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.

PLUGIN UnitechPay

CVE-2026-87841

MEDIUM CVSS 5.3 2026-10-09
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Code Snippets - Security Vulnerability (CVE-2026-106097)

The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.

PLUGIN Code Snippets

CVE-2026-106097

MEDIUM CVSS 6.8 2026-10-09
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.