sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,545
Critical3,157
High11,924
Medium24,914
Reset
Showing 161-180 of 40545 records
Threat Entry Updated 2026-11-07

Jetformbuilder - Security Vulnerability (CVE-2026-111317)

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the targeted form to have both the Save Form Record action enabled and a form-level Form Record preset configured; the stored payload only executes when a privileged user…

PLUGIN Jetformbuilder

CVE-2026-111317

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Wp Stats Manager - Security Vulnerability (CVE-2026-109230)

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'browser' parameter in all versions up to, and including, 8.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via an unauthenticated HTTP request to the public visitor tracking endpoint (wmcAction=wmcTrack) and executes when the bundled jqPlot PieRenderer inserts the HTML-decoded series label directly as…

PLUGIN Wp Stats Manager

CVE-2026-109230

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Naimur Email Otp For Woocommerce - Security Vulnerability (CVE-2026-104014)

The Naimur Email OTP Verification for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.0. This is due to the plugin's password-reset finalization endpoint (the wp_ajax_nopriv_ceovw_update_new_password action handled by CEOVW_AJAX::update_new_password()) authorizing the reset solely by the presence of a database row marking an email as 'VERIFIED', with no timestamp check, no session binding, and no per-reset token — combined with mark_otp_as_verified_for_reset() leaving the row in that state after a user enters their code (abandoning the flow leaves the row behind), and a scheduled…

PLUGIN Naimur Email Otp For Woocommerce

CVE-2026-104014

CRITICAL CVSS 9.8 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Motors Car Dealership Classified Listings - Security Vulnerability (CVE-2026-104746)

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the stm_listings_ajax_save_user_data function in all versions up to, and including, 1.4.125 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Although deletion is bounded to wp-content/uploads (preventing removal of wp-config.php), any authenticated Subscriber can trivially exploit this because…

PLUGIN Motors Car Dealership Classified Listings

CVE-2026-104746

HIGH CVSS 8.1 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

Automatorwp - Security Vulnerability (CVE-2026-104768)

The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the `create_user()` function within the anonymous-user action (and equally in the Create User and Add/Change Role WordPress-integration actions), which verify only that the submitted role exists via `automatorwp_get_editable_roles()` without confirming the role falls at or below the acting context's privilege level — allowing attacker-controlled trigger tag data (e.g., a `{comment_author}` tag bound to…

PLUGIN Automatorwp

CVE-2026-104768

HIGH CVSS 7.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Wp User Frontend - Security Vulnerability (CVE-2026-109214)

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' (default: 'category')' parameter in all versions up to, and including, 4.3.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target installation to have configured a Taxonomy field in text-input mode with guest post…

PLUGIN Wp User Frontend

CVE-2026-109214

HIGH CVSS 7.2 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

Anywhere Elementor - Security Vulnerability (CVE-2026-103914)

The Dynific Addons for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'q' parameter in versions up to, and including, 1.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the ae_preview_post() AJAX handler and its preview_post_filter() posts_where callback, where the value is passed through $wpdb->esc_like() (addcslashes for '_%\\') and concatenated into a single-quoted SQL LIKE literal — a construction that does not escape single quotes and actively escapes the backslash wp_magic_quotes places before…

PLUGIN Anywhere Elementor

CVE-2026-103914

MEDIUM CVSS 6.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Wedocs - Security Vulnerability (CVE-2026-104760)

The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because Contributors can save posts in pending status, a malicious payload in the modalPlaceholder block attribute will execute in the…

PLUGIN Wedocs

CVE-2026-104760

MEDIUM CVSS 6.4 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-08

Anywhere Elementor - Security Vulnerability (CVE-2026-102564)

The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a public post rendered through an AE template that includes the AE Post Comments widget, and for the attacker's comment to be visible on…

PLUGIN Anywhere Elementor

CVE-2026-102564

MEDIUM CVSS 6.5 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Pay Wp - Security Vulnerability (CVE-2026-121571)

Missing Authorization vulnerability in WP Desk Autopay dla WooCommerce pay-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autopay dla WooCommerce: from n/a through 2.3.0.

PLUGIN Pay Wp

CVE-2026-121571

MEDIUM CVSS 5.3 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-11

Webcam 2way Videochat - Security Vulnerability (CVE-2026-120857)

Missing Authorization vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.9.

PLUGIN Webcam 2way Videochat

CVE-2026-120857

MEDIUM CVSS 5.3 2026-11-07
Open Full Technical Breakdown
Threat Entry Updated 2026-11-07

Customer Area - Security Vulnerability (CVE-2026-120365)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.

PLUGIN Customer Area

CVE-2026-120365

MEDIUM CVSS 6.5 2026-11-07
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.