VYPR

CVEs

128,708 total · page 91 of 2,575

AllCriticalHighKEV
  • CVE-2026-94060HigOct 9, 2026
    WordPress
    Voldor
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Voldor: from n/a through 1.0.0.

  • CVE-2026-94059HigOct 9, 2026
    WordPress
    Ogency
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.

  • CVE-2026-94058HigOct 9, 2026
    WordPress
    Treck
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.

  • CVE-2026-8374HigOct 9, 2026
    SwitchBot
    SwitchBot Door Lock Series
    risk 0.55cvss —epss 0.00

    Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.

  • CVE-2026-105883HigOct 9, 2026
    WordPress
    Th Shop Mania
    risk 0.46cvss 7.1epss 0.00

    Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.

  • CVE-2026-105872HigOct 9, 2026
    WordPress
    Product Configurator for WooCommerce
    risk 0.47cvss 7.2epss 0.00

    Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce product-configurator-for-woocommerce allows Object Injection.This issue affects Product Configurator for WooCommerce: from n/a through 1.7.5.

  • CVE-2026-105870HigOct 9, 2026
    Delight Star Inc.
    WP Associate Post R2
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.

  • CVE-2026-105318HigOct 9, 2026
    WordPress
    AcyMailing SMTP Newsletter
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.

  • CVE-2026-104392HigOct 9, 2026
    WordPress
    Quiz And Survey Master
    risk 0.57cvss 8.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

  • CVE-2026-103413HigOct 9, 2026
    Apache
    Camel Karavan
    risk 0.50cvss 8.8epss 0.00

    Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting…

  • CVE-2026-103412HigOct 9, 2026
    Apache
    Camel Karavan
    risk 0.50cvss 8.8epss 0.01

    Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git…

  • CVE-2026-97791HigOct 9, 2026
    Apache
    Cxf
    risk 0.49cvss 7.5epss 0.00

    In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker…

  • CVE-2026-86463HigOct 9, 2026
    Apache
    Cxf
    risk 0.49cvss 7.5epss 0.00

    Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker…

  • CVE-2026-78384HigOct 9, 2026
    Apache
    Cxf
    risk 0.49cvss 7.5epss 0.00

    CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML…

  • CVE-2026-73179HigOct 9, 2026
    Apache
    Cxf
    risk 0.53cvss 8.1epss 0.00

    Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the…

  • CVE-2026-108039HigOct 9, 2026
    Apache
    Cxf
    risk 0.49cvss 7.5epss 0.00

    By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or…

  • CVE-2026-107937HigOct 9, 2026
    Apache
    Cxf
    risk 0.49cvss 7.5epss 0.01

    In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a…

  • CVE-2026-100227HigOct 9, 2026
    Apache
    Cxf
    risk 0.49cvss 7.5epss 0.00

    Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was…

  • CVE-2026-96761HigOct 9, 2026
    WordPress
    Welcart eCommerce
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.

  • CVE-2026-96671HigOct 9, 2026
    WordPress
    Featured Image From URL
    risk 0.57cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7.

  • CVE-2026-96607HigOct 9, 2026
    WordPress
    NEX-Forms
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1.

  • CVE-2026-96553HigOct 9, 2026
    WordPress
    Ajax Search For Woocommerce
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.

  • CVE-2026-96461HigOct 9, 2026
    WordPress
    Ameliabooking
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

  • CVE-2026-96336HigOct 9, 2026
    WordPress
    Forminator
    risk 0.49cvss 7.5epss 0.00

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

  • CVE-2026-96333HigOct 9, 2026
    WordPress
    Givewp
    risk 0.49cvss 7.5epss 0.00

    Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.

  • CVE-2026-96332HigOct 9, 2026
    WordPress
    Simple Payment
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.

  • CVE-2026-96329HigOct 9, 2026
    WordPress
    Tagdiv Opt In Builder
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.

  • CVE-2026-95610HigOct 9, 2026
    Upsolution
    UpSolution Core
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3.

  • CVE-2026-95609HigOct 9, 2026
    WordPress
    Media Library Assistant
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.

  • CVE-2026-95608HigOct 9, 2026
    Pluginus
    Woocommerce Products Filter
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.

  • CVE-2026-95607HigOct 9, 2026
    WordPress
    WPLMS
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.

  • CVE-2026-95599HigOct 9, 2026
    WordPress
    Taskbuilder
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.

  • CVE-2026-95598HigOct 9, 2026
    WordPress
    Search in Place
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.

  • CVE-2026-95596HigOct 9, 2026
    WordPress
    Shopbuilder
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons:…

  • CVE-2026-95591HigOct 9, 2026
    WordPress
    Vikbooking Hotel Booking Engine \& Pms
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14.

  • CVE-2026-94668HigOct 9, 2026
    Dimitri Grassi
    Salon booking system
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.

  • CVE-2026-94666HigOct 9, 2026
    WordPress
    Generate PDF Using Contact Form 7
    risk 0.49cvss 7.5epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1.

  • CVE-2026-94664HigOct 9, 2026
    WordPress
    PDF For Contact Form 7
    risk 0.49cvss 7.5epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.

  • CVE-2026-94663HigOct 9, 2026
    Metagauss
    Profilegrid
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.

  • CVE-2026-94661HigOct 9, 2026
    WordPress
    JetBlog
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.

  • CVE-2026-94641HigOct 9, 2026
    WordPress
    Userswp
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.

  • CVE-2026-94632HigOct 9, 2026
    WordPress
    Blockstrap Page Builder Blocks
    risk 0.39cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a…

  • CVE-2026-94568HigOct 9, 2026
    WordPress
    Pay with Vipps for WooCommerce
    risk 0.47cvss 7.2epss 0.00

    Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.

  • CVE-2026-94415HigOct 9, 2026
    WordPress
    Betheme
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.

  • CVE-2026-94170HigOct 9, 2026
    WordPress
    Sassy Social Share
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Reflected XSS.This issue affects Sassy Social Share: from n/a through 3.3.79.

  • CVE-2026-94167HigOct 9, 2026
    WordPress
    Kubio AI Page Builder
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.

  • CVE-2026-94166HigOct 9, 2026
    Upsolution
    UpSolution Core
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through 8.44.

  • CVE-2026-94161HigOct 9, 2026
    WordPress
    Grand Restaurant
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.

  • CVE-2026-94159HigOct 9, 2026
    WordPress
    Total Donations
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5.

  • CVE-2026-94158HigOct 9, 2026
    WordPress
    Gloria Admin Panel
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3.