Skip to main content
Skip to footer
Opens in a new tab
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Severity:
medium
CVE-2026-32535: JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
April 6, 2026
CVE-2026-32535 affects the Js Support Ticket plugin (versions up to 3.0.3) with a medium severity CVSS score of 4.3. Users…
CVE-2026-25376: Addon Jobsearch Chat <= 3.0 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
April 6, 2026
CVE-2026-25376 affects the Addon Jobsearch Chat plugin for WordPress (up to version 3.0) with a medium severity (CVSS 6.1) reflected…
CVE-2026-25344: Review Schema – Review & Structure Data Schema Plugin <= 2.2.6 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
April 6, 2026
CVE-2026-25344 affects the Review Schema plugin (up to v2.2.6) with a CVSS score of 4.3. Authenticated attackers can access sensitive…
CVE-2026-25035: Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe <= 28.1.2.2 Missing Authorization PoC, Patch Analysis & Rule
April 6, 2026
CVE-2026-25035 affects the Contest Gallery plugin (up to version 28.1.2.2) with a medium severity CVSS score of 5.3, allowing unauthorized…
CVE-2026-25327: Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.9 Missing Authorization PoC, Patch Analysis & Rule
April 6, 2026
CVE-2026-25327 affects the Restaurant Reservations plugin (up to v2.7.9) with a medium severity CVSS score of 5.3. Unauthenticated attackers can…
CVE-2026-25026: Team – Team Members Showcase Plugin <= 5.0.11 Missing Authorization PoC, Patch Analysis & Rule
April 6, 2026
CVE-2026-25026 affects the Tlp Team plugin (up to version 5.0.11) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized access.…
CVE-2026-32533: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
April 6, 2026
CVE-2026-32533 affects the LatePoint plugin (up to version 5.2.6) with a medium severity CVSS score of 4.3. Authenticated users can…
CVE-2026-25334: Salon Booking System Pro < 10.30.12 Missing Authorization PoC, Patch Analysis & Rule
April 6, 2026
CVE-2026-25334 affects the Salon Booking Plugin Pro (up to version 10.30.12) with a medium severity (CVSS 5.3). Unauthenticated attackers can…
CVE-2026-32485: User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 Missing Authorization PoC, Patch Analysis & Rule
April 6, 2026
CVE-2026-32485 affects the Wp User Frontend plugin (up to version 4.2.8) with a medium severity (CVSS 5.3) vulnerability allowing unauthorized…
CVE-2026-1797: Truebooker Appointment Booking and Scheduler Plugin <= 1.1.4 Sensitive Information Exposure via Views Files PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-1797 affects the Truebooker Appointment Booking plugin (up to v1.1.4) with a medium severity CVSS score of 5.3. Patch to…
CVE-2026-1877: Auto Post Scheduler <= 1.84 Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-1877 affects the Auto Post Scheduler plugin (up to v1.84) with a medium severity (CVSS 6.1) cross-site scripting vulnerability. Ensure…
CVE-2026-3191: Minify HTML <= 2.1.12 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-3191 affects the Minify HTML plugin for WordPress (up to 2.1.12) with a medium severity CVSS score of 5.4. Ensure…
CVE-2025-13535: King Addons for Elementor <= 51.1.38 Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets PoC, Patch Analysis & Rule
April 1, 2026
CVE-2025-13535 affects King Addons for Elementor (up to version 51.1.38) with a medium severity (CVSS 6.4) XSS vulnerability. Update to…
CVE-2026-2480: WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-2480 affects the Shortcodes Ultimate plugin (up to 7.4.10) with a medium severity CVSS score of 6.4. Authenticated attackers can…
CVE-2026-3139: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-3139 affects the Profile Builder plugin (up to v3.15.5) with a CVSS score of 4.3. Authenticated users can exploit this…
CVE-2026-4668: Amelia <= 2.1.2 Authenticated (Manager+) SQL Injection via 'sort' Parameter PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-4668 affects the Amelia Booking plugin (up to v2.1.2) with a medium severity (CVSS 6.5) SQL injection risk. Users should…
CVE-2026-1834: Ibtana WordPress Website Builder <= 1.2.5.7 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-1834 affects the Ibtana Visual Editor plugin (up to 1.2.5.7) with a medium severity CVSS score of 6.4. Authenticated users…
CVE-2026-3831: Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-3831 affects the Contact Form Entries plugin (up to v1.4.9) with a medium severity (CVSS 4.3). Patch to v1.5.0 to…
CVE-2026-4146: Loco Translate <= 2.8.2 Reflected Cross-Site Scripting via 'update_href' Parameter PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-4146 affects the Loco Translate plugin (up to version 2.8.2) with a medium severity XSS vulnerability (CVSS 6.1). Users should…
CVE-2026-1710: WooPayments <= 10.5.1 Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax PoC, Patch Analysis & Rule
April 1, 2026
CVE-2026-1710 affects WooCommerce Payments plugin versions up to 10.5.1, allowing unauthorized data modification. Upgrade to version 10.6.0 to mitigate this…
←
1
…
52
53
54
55
56
…
120
→