CVEs published by Patchstack

CVEs published by Patchstack (CVE Numbering Authority). 400 tracked.

CVE-2026-49108 CRITICAL 9.8 Unauthenticated PHP Object Injection in Moderno < 1.43 versions.
CVE-2026-42758 CRITICAL 9.8 Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allo
CVE-2026-27395 CRITICAL 9.8 Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.
CVE-2026-49107 CRITICAL 9.8 Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.
CVE-2026-54811 CRITICAL 9.3 Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.
CVE-2026-34893 HIGH 8.1 Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.
CVE-2026-34894 HIGH 8.1 Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.
CVE-2026-39446 HIGH 8.1 Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.
CVE-2026-39445 HIGH 8.1 Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.
CVE-2026-39559 HIGH 8.1 Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.
CVE-2026-42629 HIGH 8.8 Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions.
CVE-2026-57386 HIGH 8.8 Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalation.This i
CVE-2026-40767 HIGH 7.5 Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions.
CVE-2025-62034 HIGH 8.8 Incorrect Privilege Assignment vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.
CVE-2026-54185 HIGH 8.5 Subscriber SQL Injection in Cornerstone < 7.8.8 versions.
CVE-2025-62066 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2026-39515 MEDIUM 6.5 Subscriber Broken Access Control in Motors < 1.4.107 versions.
CVE-2026-73378 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.
CVE-2025-59571 HIGH 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethem
CVE-2026-25440 MEDIUM 5.3 Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.
CVE-2026-41557 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Kapee < 1.7.1 versions.
CVE-2026-56045 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.
CVE-2023-22685 MEDIUM 5.9 UPGRADE Auth
CVE-2026-40793 MEDIUM 6.5 Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.
CVE-2026-49773 MEDIUM 6.5 Subscriber Cross Site Scripting (XSS) in FV Flowplayer Video Player < 7.5.51.7212 versions.
CVE-2025-67539 MEDIUM 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-T
CVE-2026-28145 MEDIUM 5.3 Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipula
CVE-2025-67562 MEDIUM 5.4 Missing Authorization vulnerability in WebCodingPlace Image Caption Hover Pro image-caption-hover-pro allows E
CVE-2026-28144 MEDIUM 4.3 Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedd
CVE-2026-73343 CRITICAL 10.0 Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2025-49901 CRITICAL 9.8 Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link Directory q
CVE-2025-62025 CRITICAL 9.8 Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch:
CVE-2026-66587 CRITICAL 9.8 Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
CVE-2025-58963 CRITICAL 10.0 Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity allows Upload a Web Sh
CVE-2026-73339 CRITICAL 9.3 Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
CVE-2026-74015 CRITICAL 9.3 Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
CVE-2025-58214 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-48089 CRITICAL 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-
CVE-2025-58955 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-58958 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-58967 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-59550 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-59555 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-59558 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-59564 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-62047 CRITICAL 9.9 Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons case-addons.This issu
CVE-2025-58628 CRITICAL 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshy
CVE-2025-48090 HIGH 8.1 Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP
CVE-2026-28151 HIGH 8.1 Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
CVE-2026-28152 HIGH 8.1 Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.
CVE-2026-73181 HIGH 7.5 Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
CVE-2025-62053 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-62055 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-62035 HIGH 8.8 Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a through <
CVE-2026-66585 HIGH 7.5 Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
CVE-2025-59580 HIGH 8.8 Incorrect Privilege Assignment vulnerability in GoodLayers Goodlayers Core goodlayers-core allows Privilege Es
CVE-2025-58629 HIGH 7.5 Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Config
CVE-2026-73377 HIGH 7.5 Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2025-39463 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2026-73367 HIGH 7.2 Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.
CVE-2025-67521 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-67525 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-67526 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-67527 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-67529 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-67531 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2025-64193 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2026-73346 HIGH 7.6 Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions.
CVE-2026-73379 MEDIUM 6.5 Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
CVE-2025-62033 MEDIUM 6.5 Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.
CVE-2026-73348 MEDIUM 6.5 Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2025-54748 MEDIUM 6.5 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RomanCode MapS
CVE-2026-39564 MEDIUM 5.3 Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunsh
CVE-2026-73349 MEDIUM 5.3 Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
CVE-2026-66633 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
CVE-2026-73375 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2025-62037 MEDIUM 6.5 Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.
CVE-2025-62057 HIGH 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethem
CVE-2025-58966 HIGH 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NE
CVE-2025-58964 HIGH 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup
CVE-2025-59556 HIGH 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup
CVE-2025-62036 HIGH 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper To
CVE-2025-67572 MEDIUM 5.3 Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Ac
CVE-2025-67573 MEDIUM 5.3 Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Acce
CVE-2025-60182 HIGH 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco
CVE-2025-64189 HIGH 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme X
CVE-2025-64376 HIGH 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioSt
CVE-2026-73357 MEDIUM 6.5 Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions.
CVE-2025-49936 MEDIUM 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos W
CVE-2025-62005 HIGH 7.1 Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomembe
CVE-2025-64197 MEDIUM 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Re
CVE-2025-62032 MEDIUM 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv t
CVE-2025-67538 MEDIUM 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme
CVE-2025-67544 MEDIUM 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowt
CVE-2026-39526 MEDIUM 5.4 Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting
CVE-2025-59593 MEDIUM 5.9 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend T
CVE-2025-64202 MEDIUM 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs
CVE-2025-68532 MEDIUM 6.5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in modelthe
CVE-2026-28147 MEDIUM 5.4 Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addo
CVE-2026-97301 MEDIUM 6.5 Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
CVE-2025-64212 MEDIUM 5.4 Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-
CVE-2026-39484 MEDIUM 4.7 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hide-my-wp a
CVE-2025-66056 MEDIUM 4.3 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncann
CVE-2025-66532 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in Mikado-Themes Powerlift powerlift allows Exploiting Incorrectly Configu
CVE-2026-39572 MEDIUM 4.3 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus
CVE-2025-62028 MEDIUM 4.3 Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from n/a throug
CVE-2026-39506 MEDIUM 4.3 Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting Incorrectly
CVE-2025-67591 MEDIUM 4.3 Cross-Site Request Forgery (CSRF) vulnerability in jegtheme JNews Paywall jnews-paywall allows Cross Site Requ
CVE-2026-65553 CRITICAL 10.0 Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
CVE-2026-28139 CRITICAL 9.8 Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
CVE-2026-65556 CRITICAL 9.8 Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
CVE-2026-65571 CRITICAL 9.8 Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
CVE-2026-65572 CRITICAL 9.8 Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
CVE-2026-65574 CRITICAL 9.8 Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
CVE-2026-65575 CRITICAL 9.8 Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
CVE-2026-65576 CRITICAL 9.8 Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.
CVE-2026-65577 CRITICAL 9.8 Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
CVE-2026-65579 CRITICAL 9.8 Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.
CVE-2026-65581 CRITICAL 9.8 Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.
CVE-2026-66662 CRITICAL 9.8 Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
CVE-2026-66665 CRITICAL 10.0 Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
CVE-2026-73376 CRITICAL 9.8 Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2025-58627 CRITICAL 9.8 Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculo
CVE-2026-28005 CRITICAL 9.8 Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.
CVE-2026-65507 CRITICAL 9.8 Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions.
CVE-2026-65552 CRITICAL 9.8 Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
CVE-2026-65573 CRITICAL 9.8 Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
CVE-2026-65578 CRITICAL 9.8 Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
CVE-2026-65548 CRITICAL 9.9 Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.
CVE-2026-65508 CRITICAL 9.3 Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.
CVE-2026-65520 CRITICAL 9.3 Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
CVE-2026-65546 CRITICAL 9.3 Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
CVE-2026-66447 CRITICAL 9.3 Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
CVE-2026-66709 CRITICAL 9.1 Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
CVE-2026-65570 HIGH 8.1 Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
CVE-2026-65542 HIGH 8.8 Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
CVE-2026-66708 HIGH 8.2 Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
CVE-2026-28111 HIGH 8.8 Contributor Privilege Escalation in Forminator <= 1.56.0 versions.
CVE-2026-65543 HIGH 7.5 Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.
CVE-2026-65551 HIGH 7.5 Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Contr
CVE-2026-65504 HIGH 7.5 Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.
CVE-2026-65523 HIGH 7.5 Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automat
CVE-2025-64213 HIGH 7.5 Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro masterst
CVE-2026-28140 HIGH 7.5 Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.
CVE-2026-66712 HIGH 7.5 Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
CVE-2026-65547 HIGH 8.5 Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.
CVE-2026-65569 HIGH 8.5 Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions.
CVE-2025-49935 HIGH 7.5 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
CVE-2026-65541 HIGH 7.3 Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.
CVE-2026-65549 HIGH 7.2 Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.

← Back to latest CVEs