| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-60230 | Cri | 0.64 | 9.8 | 0.00 | Jun 17, 2026 | Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9. | ||
| CVE-2025-60229 | Cri | 0.64 | 9.8 | 0.00 | Jun 17, 2026 | Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0. | ||
| CVE-2025-59554 | Cri | 0.60 | 9.3 | 0.00 | Jun 17, 2026 | Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions. | ||
| CVE-2025-15657 | Med | 0.34 | 5.3 | 0.00 | Jun 17, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions. | ||
| CVE-2026-9690 | Hig | 0.49 | 7.5 | 0.01 | Jun 17, 2026 | Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions. | ||
| CVE-2026-9570 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any… | ||
| CVE-2026-8607 | Med | 0.35 | 6.4 | 0.00 | Jun 17, 2026 | The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrap' Shortcode Attribute in all versions up to, and including, 3.1 due to insufficient input sanitization… | ||
| CVE-2026-8494 | Med | 0.42 | 6.4 | 0.00 | Jun 17, 2026 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers,… | ||
| CVE-2026-8383 | Med | 0.34 | 5.3 | 0.01 | Jun 17, 2026 | The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and… | ||
| CVE-2026-8317 | — | 0.00 | — | — | Jun 17, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||
| CVE-2026-8089 | Hig | 0.46 | 7.1 | 0.01 | Jun 17, 2026 | The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing… | ||
| CVE-2026-7850 | Med | 0.38 | 5.9 | 0.00 | Jun 17, 2026 | The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site… | ||
| CVE-2026-5667 | Hig | 0.47 | — | 0.00 | Jun 17, 2026 | Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Packaged Air Conditioners (for Japan and outside… | ||
| CVE-2026-55706 | Med | 0.31 | 5.8 | 0.00 | Jun 17, 2026 | sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths. | ||
| CVE-2026-54811 | Cri | 0.60 | 9.3 | 0.00 | Jun 17, 2026 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. | ||
| CVE-2026-54807 | Cri | 0.64 | 9.8 | 0.00 | Jun 17, 2026 | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions. | ||
| CVE-2026-54806 | Cri | 0.64 | 9.8 | 0.01 | Jun 17, 2026 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | ||
| CVE-2026-54805 | Hig | 0.57 | 8.8 | 0.00 | Jun 17, 2026 | Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions. | ||
| CVE-2026-54804 | Hig | 0.49 | 7.6 | 0.00 | Jun 17, 2026 | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. | ||
| CVE-2026-54803 | Cri | 0.64 | 9.8 | 0.00 | Jun 17, 2026 | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions. | ||
| CVE-2026-54802 | Hig | 0.49 | 7.5 | 0.00 | Jun 17, 2026 | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions. | ||
| CVE-2026-54196 | Med | 0.44 | 6.8 | 0.00 | Jun 17, 2026 | Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1. | ||
| CVE-2026-54195 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. | ||
| CVE-2026-54194 | Cri | 0.64 | 9.8 | 0.01 | Jun 17, 2026 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | ||
| CVE-2026-54192 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions. | ||
| CVE-2026-54189 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | ||
| CVE-2026-54188 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions. | ||
| CVE-2026-54187 | Cri | 0.60 | 9.3 | 0.00 | Jun 17, 2026 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. | ||
| CVE-2026-54186 | Cri | 0.60 | 9.3 | 0.00 | Jun 17, 2026 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. | ||
| CVE-2026-54185 | Hig | 0.55 | 8.5 | 0.00 | Jun 17, 2026 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. | ||
| CVE-2026-54184 | Hig | 0.53 | 8.2 | 0.00 | Jun 17, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions. | ||
| CVE-2026-53876 | Hig | 0.47 | 7.2 | 0.02 | Jun 17, 2026 | RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who logs in to the web console as an administrator. | ||
| CVE-2026-52706 | Cri | 0.64 | 9.8 | 0.01 | Jun 17, 2026 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | ||
| CVE-2026-52705 | Cri | 0.59 | 9.0 | 0.00 | Jun 17, 2026 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions. | ||
| CVE-2026-52698 | Hig | 0.48 | 7.4 | 0.00 | Jun 17, 2026 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions. | ||
| CVE-2026-52696 | Hig | 0.49 | 7.5 | 0.00 | Jun 17, 2026 | Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions. | ||
| CVE-2026-50203 | Cri | 0.52 | 9.1 | 0.01 | Jun 17, 2026 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is… | ||
| CVE-2026-49778 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. | ||
| CVE-2026-49767 | Cri | 0.64 | 9.8 | 0.01 | Jun 17, 2026 | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. | ||
| CVE-2026-49113 | Hig | 0.55 | 8.5 | 0.00 | Jun 17, 2026 | Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions. | ||
| CVE-2026-49107 | Cri | 0.64 | 9.8 | 0.01 | Jun 17, 2026 | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | ||
| CVE-2026-49084 | Cri | 0.60 | 9.3 | 0.00 | Jun 17, 2026 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. | ||
| CVE-2026-49081 | Hig | 0.53 | 8.2 | 0.00 | Jun 17, 2026 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. | ||
| CVE-2026-49080 | Cri | 0.60 | 9.3 | 0.00 | Jun 17, 2026 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. | ||
| CVE-2026-49079 | Cri | 0.60 | 9.3 | 0.00 | Jun 17, 2026 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. | ||
| CVE-2026-49076 | Cri | 0.60 | 9.3 | 0.00 | Jun 17, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1. | ||
| CVE-2026-49075 | Cri | 0.64 | 9.8 | 0.01 | Jun 17, 2026 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. | ||
| CVE-2026-49074 | Hig | 0.46 | 7.1 | 0.00 | Jun 17, 2026 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions. | ||
| CVE-2026-49073 | Hig | 0.55 | 8.5 | 0.00 | Jun 17, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3. | ||
| CVE-2026-49072 | Med | 0.42 | 6.5 | 0.00 | Jun 17, 2026 | Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions. |
- risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9.
- risk 0.64cvss 9.8epss 0.00
Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0.
- risk 0.60cvss 9.3epss 0.00
Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.
- risk 0.49cvss 7.5epss 0.01
Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versions.
- risk 0.46cvss 7.1epss 0.00
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any…
- risk 0.35cvss 6.4epss 0.00
The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrap' Shortcode Attribute in all versions up to, and including, 3.1 due to insufficient input sanitization…
- risk 0.42cvss 6.4epss 0.00
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers,…
- risk 0.34cvss 5.3epss 0.01
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and…
- CVE-2026-8317Jun 17, 2026risk 0.00cvss —epss —
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- risk 0.46cvss 7.1epss 0.01
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing…
- risk 0.38cvss 5.9epss 0.00
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site…
- risk 0.47cvss —epss 0.00
Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Room Air Conditioners (for Japan and outside Japan); Wireless LAN Adapters for Packaged Air Conditioners (for Japan and outside…
- risk 0.31cvss 5.8epss 0.00
sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.
- risk 0.60cvss 9.3epss 0.00
Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.
- risk 0.64cvss 9.8epss 0.00
Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.
- risk 0.64cvss 9.8epss 0.01
Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.
- risk 0.57cvss 8.8epss 0.00
Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.
- risk 0.49cvss 7.6epss 0.00
Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.
- risk 0.64cvss 9.8epss 0.00
Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.
- risk 0.44cvss 6.8epss 0.00
Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.
- risk 0.64cvss 9.8epss 0.01
Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Popup box <= 6.2.9 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.
- risk 0.60cvss 9.3epss 0.00
Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions.
- risk 0.60cvss 9.3epss 0.00
Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions.
- risk 0.55cvss 8.5epss 0.00
Subscriber SQL Injection in Cornerstone < 7.8.8 versions.
- risk 0.53cvss 8.2epss 0.00
Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.
- risk 0.47cvss 7.2epss 0.02
RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who logs in to the web console as an administrator.
- risk 0.64cvss 9.8epss 0.01
Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.
- risk 0.59cvss 9.0epss 0.00
Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.
- risk 0.48cvss 7.4epss 0.00
Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.
- risk 0.52cvss 9.1epss 0.01
A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions.
- risk 0.64cvss 9.8epss 0.01
Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions.
- risk 0.55cvss 8.5epss 0.00
Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.
- risk 0.64cvss 9.8epss 0.01
Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.
- risk 0.60cvss 9.3epss 0.00
Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions.
- risk 0.53cvss 8.2epss 0.00
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.
- risk 0.60cvss 9.3epss 0.00
Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.
- risk 0.60cvss 9.3epss 0.00
Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions.
- risk 0.60cvss 9.3epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injection.This issue affects JetEngine: from n/a through 3.8.9.1.
- risk 0.64cvss 9.8epss 0.01
Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.9.1 versions.
- risk 0.55cvss 8.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.