🔍 Filter Threats
| Title | Severity | PoC | Actively Exploited | Source | Date |
|---|---|---|---|---|---|
| CVE-2026-103917 MEDIUM The The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all vers... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-123881 MEDIUM A vulnerability was found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This issue affects the function fetch_chat_rec... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-97191 LOW The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not re-apply its field-group location rules when persisting values submitted th... | LOW | ????? | ????? | NVD | 6 days ago |
| CVE-2026-97190 LOW The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to i... | LOW | ????? | ????? | NVD | 6 days ago |
| CVE-2026-97189 LOW The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of i... | LOW | ????? | ????? | NVD | 6 days ago |
| CVE-2026-122001 HIGH The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly validate the authenticity of REST API requests, overriding WordPress&... | HIGH | ????? | ????? | NVD | 6 days ago |
| CVE-2026-121866 HIGH The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option... | HIGH | ????? | ????? | NVD | 6 days ago |
| CVE-2026-121858 MEDIUM The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several ... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-121857 MEDIUM The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or remo... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-121848 HIGH The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen accoun... | HIGH | ????? | ????? | NVD | 6 days ago |
| CVE-2026-121796 MEDIUM The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-121492 MEDIUM The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-121491 CRITICAL The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unpr... | CRITICAL | ????? | ????? | NVD | 6 days ago |
| CVE-2026-121380 MEDIUM The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the ... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-121379 CRITICAL The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it w... | CRITICAL | ????? | ????? | NVD | 6 days ago |
| CVE-2026-119073 MEDIUM The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outp... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-118534 MEDIUM The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by ... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-118533 MEDIUM The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-118532 MEDIUM The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs... | MEDIUM | ????? | ????? | NVD | 6 days ago |
| CVE-2026-118530 MEDIUM The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edi... | MEDIUM | ????? | ????? | NVD | 6 days ago |