Explore CVE records

MedPublished 29 Oct 2026, 21:38 WIB

CVE-2026-27062

WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:39 WIB

Official record

MedPublished 29 Oct 2026, 21:32 WIB

CVE-2026-54853

WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.

Excerpt language: en.

MedPublished 29 Oct 2026, 21:32 WIB

CVE-2026-114706

WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:33 WIB

Official record

MedPublished 29 Oct 2026, 21:32 WIB

CVE-2026-27063

WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:33 WIB

Official record

MedPublished 29 Oct 2026, 21:31 WIB

CVE-2026-115601

WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:33 WIB

Official record

MedPublished 29 Oct 2026, 21:29 WIB

CVE-2026-115605

WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:30 WIB

Official record

MedPublished 29 Oct 2026, 21:29 WIB

CVE-2026-118095

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:30 WIB

Official record

MedPublished 29 Oct 2026, 21:29 WIB

CVE-2026-54871

WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.2.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:30 WIB

Official record

MedPublished 29 Oct 2026, 21:29 WIB

CVE-2026-25450

WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:29 WIB

Official record

MedPublished 29 Oct 2026, 21:29 WIB

CVE-2026-116850

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:30 WIB

Official record

MedPublished 29 Oct 2026, 21:28 WIB

CVE-2026-114181

WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:29 WIB

Official record

MedPublished 29 Oct 2026, 21:26 WIB

CVE-2026-118088

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:27 WIB

Official record

MedPublished 29 Oct 2026, 21:26 WIB

CVE-2026-116849

WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:26 WIB

Official record

MedPublished 29 Oct 2026, 21:25 WIB

CVE-2026-110881

WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:26 WIB

Official record

MedPublished 29 Oct 2026, 21:24 WIB

CVE-2026-116856

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for W…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:24 WIB

Official record

MedPublished 29 Oct 2026, 21:24 WIB

CVE-2026-39737

WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:24 WIB

Official record

MedPublished 29 Oct 2026, 21:23 WIB

CVE-2026-118091

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:24 WIB

Official record

MedPublished 29 Oct 2026, 21:22 WIB

CVE-2026-116387

WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:23 WIB

Official record

MedPublished 29 Oct 2026, 21:20 WIB

CVE-2026-39742

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:37 WIB

Official record

MedPublished 29 Oct 2026, 21:20 WIB

CVE-2026-115610

WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:20 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage