| CVE-2026-118418 | NA | N/A | The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its pub… | 2026-11-11 |
| CVE-2026-118420 | NA | N/A | The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in… | 2026-11-11 |
| CVE-2026-118439 | NA | N/A | The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server… | 2026-11-11 |
| CVE-2026-119032 | NA | N/A | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user … | 2026-11-11 |
| CVE-2026-119033 | NA | N/A | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a … | 2026-11-11 |
| CVE-2026-119034 | NA | N/A | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly… | 2026-11-11 |
| CVE-2026-119035 | NA | N/A | The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured d… | 2026-11-11 |
| CVE-2026-119303 | NA | N/A | The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its … | 2026-11-11 |
| CVE-2026-119529 | NA | N/A | The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated… | 2026-11-11 |
| CVE-2026-119531 | NA | N/A | The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builde… | 2026-11-11 |
| CVE-2026-121472 | NA | N/A | The AutomatorWP WordPress plugin before 6.0.8 does not bind the requests that complete its Zoom and AWeber in… | 2026-11-11 |
| CVE-2026-121497 | NA | N/A | The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat… | 2026-11-11 |
| CVE-2026-121862 | NA | N/A | The Knowledge Building WordPress plugin before 0.7.3 does not sanitise and escape comments submitted through i… | 2026-11-11 |
| CVE-2026-121863 | NA | N/A | The Knowledge Building WordPress plugin before 0.7.3 does not escape several user-supplied values before echoi… | 2026-11-11 |
| CVE-2026-121870 | NA | N/A | The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks… | 2026-11-11 |
| CVE-2026-121873 | NA | N/A | The Redirection for Contact Form 7 WordPress plugin before 3.2.16 does not verify ownership of the email addre… | 2026-11-11 |
| CVE-2026-121998 | NA | N/A | The iChart WordPress plugin before 2.2.4 does not perform capability or ownership checks in several of its AJ… | 2026-11-11 |
| CVE-2026-122061 | NA | N/A | The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event … | 2026-11-11 |
| CVE-2026-122087 | NA | N/A | The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events … | 2026-11-11 |
| CVE-2026-123134 | NA | N/A | The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape a… | 2026-11-11 |
| CVE-2026-123656 | NA | N/A | The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content protection ru… | 2026-11-11 |
| CVE-2026-123657 | NA | N/A | The ProfilePress WordPress plugin before 4.17.6 does not reject negative membership plan identifiers before c… | 2026-11-11 |
| CVE-2026-123661 | NA | N/A | The ProfilePress WordPress plugin before 4.17.4 does not check that a membership plan is still active when ch… | 2026-11-11 |
| CVE-2026-123666 | NA | N/A | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may de… | 2026-11-11 |
| CVE-2026-123667 | NA | N/A | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyw… | 2026-11-11 |
| CVE-2026-123695 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST A… | 2026-11-11 |
| CVE-2026-123696 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised b… | 2026-11-11 |
| CVE-2026-123697 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's curren… | 2026-11-11 |
| CVE-2026-123698 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API r… | 2026-11-11 |
| CVE-2026-123699 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised b… | 2026-11-11 |
| CVE-2026-123700 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised b… | 2026-11-11 |
| CVE-2026-123701 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when re… | 2026-11-11 |
| CVE-2026-123702 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised b… | 2026-11-11 |
| CVE-2026-123703 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised b… | 2026-11-11 |
| CVE-2026-123704 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API r… | 2026-11-11 |
| CVE-2026-123705 | NA | N/A | The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API r… | 2026-11-11 |
| CVE-2026-88813 | NA | N/A | The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it… | 2026-11-11 |
| CVE-2026-96414 | NA | N/A | In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined … | 2026-11-11 |
| CVE-2025-59847 | MEDIUM | 6.8 | HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allow… | 2026-11-11 |
| CVE-2025-59848 | MEDIUM | 6.8 | HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing… | 2026-11-11 |
| CVE-2026-105948 | NA | N/A | In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allo… | 2026-11-11 |
| CVE-2026-111190 | HIGH | 8.1 | The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, … | 2026-11-11 |
| CVE-2026-116468 | MEDIUM | 6.6 | A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services compo… | 2026-11-11 |
| CVE-2026-119171 | MEDIUM | 5.3 | The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not va… | 2026-11-11 |
| CVE-2026-119302 | MEDIUM | 6.5 | The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check… | 2026-11-11 |
| CVE-2026-123659 | MEDIUM | 5.3 | The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member di… | 2026-11-11 |
| CVE-2026-123668 | MEDIUM | 5.3 | The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are wh… | 2026-11-11 |
| CVE-2026-12062 | HIGH | 8.8 | Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injectio… | 2026-11-11 |
| CVE-2026-12424 | HIGH | 7.2 | The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versio… | 2026-11-11 |
| CVE-2026-12427 | HIGH | 7.2 | The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter … | 2026-11-11 |