sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 1761-1780 of 40783 records
Threat Entry Updated 2026-10-07

Yaad Sarig Payment Gateway For WC - Security Vulnerability (CVE-2026-104651)

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to other customers.

PLUGIN Yaad Sarig Payment Gateway For WC

CVE-2026-104651

MEDIUM CVSS 4.3 2026-10-07
Open Full Technical Breakdown
Threat Entry Updated 2026-10-07

Academy LMS - Security Vulnerability (CVE-2026-104050)

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to read the quiz answer options of questions belonging to other courses they are not enrolled in.

PLUGIN Academy LMS

CVE-2026-104050

MEDIUM CVSS 4.3 2026-10-07
Open Full Technical Breakdown
Threat Entry Updated 2026-10-07

Academy LMS - Security Vulnerability (CVE-2026-104049)

The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbitrary lessons, including lessons of paid or private courses they are not enrolled in.

PLUGIN Academy LMS

CVE-2026-104049

MEDIUM CVSS 4.3 2026-10-07
Open Full Technical Breakdown
Threat Entry Updated 2026-10-07

Frontend Dashboard - Security Vulnerability (CVE-2026-103681)

The Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users with low privileges, such as subscribers, to delete the Frontend Dashboard WordPress plugin before 3.0.0's configured profile and post form fields.

PLUGIN Frontend Dashboard

CVE-2026-103681

MEDIUM CVSS 4.3 2026-10-07
Open Full Technical Breakdown
Threat Entry Updated 2026-10-07

Kirki – Freeform Page Builder, Website Builder & Customizer - Security Vulnerability (CVE-2026-102173)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration…

THEME Kirki – Freeform Page Builder, Website Builder & Customizer

CVE-2026-102173

HIGH CVSS 7.2 2026-10-07
Open Full Technical Breakdown
Threat Entry Updated 2026-10-12

Sms Alert - Security Vulnerability (CVE-2026-95594)

Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.

PLUGIN Sms Alert

CVE-2026-95594

HIGH CVSS 8.1 2026-10-06
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.