sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total40,783
Critical3,170
High11,980
Medium25,054
Reset
Showing 1881-1900 of 40783 records
Threat Entry Updated 2026-10-06

elegro Crypto Payment - Security Vulnerability (CVE-2026-94299)

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where that secret has been left at its default empty value.

PLUGIN elegro Crypto Payment

CVE-2026-94299

MEDIUM CVSS 6.5 2026-10-06
Open Full Technical Breakdown
Threat Entry Updated 2026-10-06

File Media Renamer - Security Vulnerability (CVE-2026-94278)

The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrators, and to corrupt unrelated stored site data that referenced the old file path.

PLUGIN File Media Renamer

CVE-2026-94278

MEDIUM CVSS 5.5 2026-10-06
Open Full Technical Breakdown
Threat Entry Updated 2026-10-06

Deema Payment Gateway - Security Vulnerability (CVE-2026-94271)

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.

PLUGIN Deema Payment Gateway

CVE-2026-94271

MEDIUM CVSS 5.3 2026-10-06
Open Full Technical Breakdown
Threat Entry Updated 2026-10-06

Deema Payment Gateway - Security Vulnerability (CVE-2026-94270)

The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or to cancel or refund an existing order.

PLUGIN Deema Payment Gateway

CVE-2026-94270

MEDIUM CVSS 5.3 2026-10-06
Open Full Technical Breakdown
Threat Entry Updated 2026-10-06

Fast Courier - Security Vulnerability (CVE-2026-89289)

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

PLUGIN Fast Courier

CVE-2026-89289

MEDIUM CVSS 5.3 2026-10-06
Open Full Technical Breakdown
Threat Entry Updated 2026-10-06

Slider Pro - Security Vulnerability (CVE-2026-86786)

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.

PLUGIN Slider Pro

CVE-2026-86786

MEDIUM CVSS 5.3 2026-10-06
Open Full Technical Breakdown
Threat Entry Updated 2026-10-06

ACPT - Security Vulnerability (CVE-2026-105701)

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig…

PLUGIN ACPT

CVE-2026-105701

HIGH CVSS 8.8 2026-10-06
Open Full Technical Breakdown
Threat Entry Updated 2026-10-09

Post Smtp - Security Vulnerability (CVE-2026-75962)

The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable without authentication on WordPress Multisite installations with public registration enabled, as WordPress accepts email addresses…

PLUGIN Post Smtp

CVE-2026-75962

HIGH CVSS 7.2 2026-10-06
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.