Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 03:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

149-75% vs 7-day avg of 597

2 critical, 41 high, 60 medium, 26 low

Expand	Severity	Score	Advisory	Title	Source	Published
	Medium	6.5	CVE-2026-114194	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects... Igor Funa, WordPressIgor Funa Ad Inserter, WordPress Ad Inserter Plugin	NVD	Oct 24 10:17 UTC
CVE-2026-114194Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects... From the advisory Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Affects Igor Funa WordPress Igor Funa Ad Inserter WordPress Ad Inserter Plugin NIST National Vulnerability DatabasePublished Oct 24, 2026 10:17 UTC Read the advisory
	High	7.1	CVE-2026-115807	The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all... Cozmoslabs, WordPress, User Profile BuilderCozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, User Profile Builder, WordPress	NVD	Oct 24 05:17 UTC
CVE-2026-115807The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all... Executive summary The User Profile Builder plugin for WordPress contains a flaw that lets users with Author-level access and above create new accounts with higher-privilege roles such as Editor. The advisory describes this as a limited privilege escalation affecting all versions up to and including 4.0.3. The advisory does not state a severity rating or a vendor fix recommendation. Technical summary The flaw is a privilege escalation caused by missing server-side authorization: the Gutenberg Register block passes an attacker-controlled Assigned Role attribute into the [wppb-register] shortcode. The role guard only downgrades roles holding manage_options or remove_users, so roles such as Editor are not restricted. Exploitation requires an authenticated attacker with Author-level access or higher. Affected versions are stated as all versions up to and including 4.0.3, and a fixed version is not stated. A CVSS score, workarounds, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Affects Cozmoslabs WordPress User Profile Builder Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor User Profile Builder WordPress NIST National Vulnerability DatabasePublished Oct 24, 2026 05:17 UTC Read the advisory
	Critical	9.8	CVE-2026-112859	Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. ThemeREX Group, WordPressThemeREX Group Little Birdies, WordPress Little Birdies Theme	NVD	Oct 23 13:17 UTC
CVE-2026-112859Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. Executive summary A PHP Object Injection flaw in the Little Birdies WordPress theme, published by ThemeREX Group, affects all versions up to and including 1.3.16. The advisory rates it 9.8 CVSS and high priority, and says it is expected to be exploited in mass campaigns. It states that no official patch is available, and the recommended immediate action is to update the theme if a fix exists, or to ask a hosting provider or web developer for help while a mitigation rule is used. Technical summary The flaw is an insecure deserialization of untrusted data (PHP Object Injection, OWASP A3: Injection) in the Little Birdies theme. The advisory states it requires no privileges (unauthenticated access). Affected versions are listed as from n/a through 1.3.16 and <= 1.3.16. No patched version is stated, and the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released, which is the only workaround described. The advisory does not state specific detection indicators, and it does not say whether exploitation in the wild has been observed beyond the expectation that it will be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects ThemeREX Group WordPress ThemeREX Group Little Birdies WordPress Little Birdies Theme NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	8.1	CVE-2026-112850	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local... AncoraThemes, WordPressAncoraThemes Your Dress, WordPress Your Dress Theme	NVD	Oct 23 13:17 UTC
CVE-2026-112850Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local... Executive summary A local file inclusion flaw affects the Your Dress WordPress theme by AncoraThemes, in versions 1.4.1 and earlier. Patchstack rates it high priority with a CVSS severity of 8.1, and says attackers could make the site load server files it should not, sometimes leading to a takeover. The advisory says no official patch is available yet, and recommends updating the affected theme or, if that is not possible, asking a hosting provider or web developer for help. Technical summary The weakness is classed as Improper Control of Filename for Include/Require Statement, also described as PHP Remote File Inclusion, and Patchstack classifies it as Local File Inclusion under OWASP A3: Injection. The advisory states that it requires no authentication (required privilege: unauthenticated). Affected versions are stated as <= 1.4.1, and the advisory says no official patched version is available. The advisory states that Patchstack has issued a mitigation rule to block attacks until an official patch can be tested and applied. No specific workaround beyond that rule, no detailed exploitation steps, and no detection indicators are stated, and it is not stated whether exploitation in the wild has been observed beyond the claim that it is expected to be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects AncoraThemes WordPress AncoraThemes Your Dress WordPress Your Dress Theme NIST National Vulnerability DatabasePublished Oct 23, 2026 13:17 UTC Read the advisory
	High	7.5	CVE-2026-115497	The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter codepeople, WordPresscodepeople Music Store – WordPress eCommerce, WordPress The Music Store	NVD	Oct 23 05:17 UTC
CVE-2026-115497The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter Executive summary The Music Store WordPress eCommerce plugin is affected by a flaw that lets attackers read arbitrary files on the server, potentially exposing sensitive information. The advisory says all versions up to and including 1.4.7 are affected. The advisory does not state a vendor fix or recommended action beyond describing the issue. Technical summary The vulnerability is a directory traversal (path traversal) through the 'f' parameter, affecting all versions up to and including 1.4.7. Per the advisory, an unauthenticated attacker can read the contents of arbitrary files, which may contain sensitive information. Exploitation requires a valid purchase_id token, which the advisory says any user can obtain through a single low-cost purchase or a shared download link. The advisory does not state a fixed version, a workaround, CVSS score, exploitation in the wild, or detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affects codepeople WordPress codepeople Music Store – WordPress eCommerce WordPress The Music Store NIST National Vulnerability DatabasePublished Oct 23, 2026 05:17 UTC Read the advisory
	High	8.8	CVE-2022-51021	NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by... WPDeveloper, WordPress, NotificationXWPDeveloper NotificationX, WordPress, NotificationX	NVD	Oct 22 11:17 UTC
CVE-2022-51021NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by... Executive summary The NotificationX plugin for WordPress, in versions 2.0.0 before 2.3.12, contains an SQL injection flaw that the advisory says can be exploited without logging in. The advisory states the fix is in version 2.3.12, and the excerpt does not give a severity score from the publisher, though a related template labels it high. Technical summary This is an SQL injection flaw (CWE-89) in the notificationx/v1/notification REST endpoint, where the id parameter is used in a SQL statement without validation or escaping. The advisory says it is unauthenticated, and the proof-of-concept uses a time-based payload with SLEEP to confirm the injection, with a response check for status 401 and a JSON message. Affected versions are stated as 2.0.0 before 2.3.12, and the fixed version is 2.3.12. Workarounds are not stated. Exploitation in the wild and a CVSS score are not stated. Detection guidance is limited to the included time-based test request against /wp-json/notificationx/v1/notification/1 with a delayed response. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/projectdiscovery/nuclei-temp…ificationx-sqli.yaml Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects WPDeveloper WordPress NotificationX WPDeveloper NotificationX WordPress NotificationX NIST National Vulnerability DatabasePublished Oct 22, 2026 11:17 UTC Read the advisory
	High	8.7	CVE-2019-25779	WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php WooThemes, WordPressWooThemes Diarise, WordPress Diarise	NVD	Oct 22 11:17 UTC
CVE-2019-25779WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php Executive summary The WooThemes Diarise WordPress theme, through version 1.5.9, contains a flaw that lets anyone without logging in read arbitrary files from the affected server. The advisory does not state a severity score from the vendor, though a third-party posting lists the risk as Medium in one place and High in another. The advisory does not state a vendor fix or recommended action. Technical summary The flaw is a file read vulnerability (the advisory's third-party posting cites CWE-98, which concerns PHP remote file inclusion) in the calendar parameter of download.php. Unauthenticated remote attackers can supply a file path through that parameter and retrieve its contents, as shown by a proof of concept reading /etc/passwd. Affected versions are stated as through 1.5.9, and no fixed version is stated. No workaround is stated. The advisory does not state whether the issue is patched, and it gives no detection guidance beyond the example request, which is a GET to /wp-content/themes/diarise/download.php with a file:///etc/passwd value in the calendar parameter. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cxsecurity.com/issue/WLB-2019050123 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects WooThemes WordPress WooThemes Diarise WordPress Diarise NIST National Vulnerability DatabasePublished Oct 22, 2026 11:17 UTC Read the advisory
	High	8.7	CVE-2017-20287	Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the... Javo Themes, WordPressJavo Themes Javo Spot	NVD	Oct 22 11:17 UTC
CVE-2017-20287Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the... Executive summary The Javo Spot theme for WordPress contains an unauthenticated file-read flaw that lets anyone on the internet read arbitrary files from the server, including WordPress configuration files that hold database credentials. The advisory does not give a CVSS severity score. The advisory states that the theme vendor has fixed the issue, but it does not state a fixed version number, so administrators should confirm they are running the updated theme or apply the workaround. Technical summary This is a path traversal (local file inclusion) flaw in the jvfrm_spot_get_json AJAX action, reachable without authentication through the wp_ajax_nopriv hook. The attacker supplies a traversal sequence in the fn GET parameter, which is appended to the uploads directory and read, and the callback parameter must also be non-empty. The advisory says the flaw is in the Javo Spot theme before 3.0.0, but the fixed version is not stated beyond the vendor saying the issue was resolved. The advisory's suggested workaround is to remove the wp_ajax_jvfrm_spot_get_json and wp_ajax_nopriv_jvfrm_spot_get_json hooks through a functions.php snippet. No detection guidance, CVSS score, or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from codeseekah.com/2017/02/09/javo-themes-spot-lfi-vulnerability Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Javo Themes WordPress Javo Themes Javo Spot NIST National Vulnerability DatabasePublished Oct 22, 2026 11:17 UTC Read the advisory
	Medium	4.9	CVE-2026-114570	WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names WordPress Foundation, WordPressWordPress Foundation WordPress, WordPress Core	NVD	Oct 22 06:17 UTC
CVE-2026-114570WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names Executive summary WordPress Core is affected by a stored cross-site scripting flaw in Quick Edit, present in all versions up to and including 7.0.2. The advisory says WordPress 7.0.3 bundles several security fixes and recommends updating sites immediately. Technical summary The Quick Edit flaw is stored cross-site scripting caused by insufficient escaping of user display names, affecting all versions up to and including 7.0.2. The advisory's release notes list related fixes in 7.0.3 for stored XSS in Quick Edit on sites with many users, and a Contributor+ stored XSS via the Post Content block, among others. The attack vector and exact preconditions for the Quick Edit issue are not stated beyond the reporter credit for large-user sites, and CVSS score is not stated. Fixed version for the Quick Edit issue is 7.0.3 by implication of the release, but the advisory does not explicitly map it, and workarounds are not stated. Backports to older branches are in progress and their versions are not stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wordpress.org/news/2026/08/wordpress-7-0-3-release Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N Affects WordPress Foundation WordPress WordPress Foundation WordPress WordPress Core NIST National Vulnerability DatabasePublished Oct 22, 2026 06:17 UTC Read the advisory
	Medium	4.3	CVE-2026-114176	Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects... DigitalME, WordPressDigitalME eRoom, DigitalME eroom-zoom-meetings-webinar, WordPress eRoom Plugin	NVD	Oct 21 18:17 UTC
CVE-2026-114176Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects... Executive summary A broken access control flaw affects the eRoom WordPress plugin by DigitalME, in versions 1.7.1 and earlier. The advisory rates it low severity with a CVSS score of 4.3 and says it is unlikely to be exploited. The vendor recommends updating to version 1.7.2 or later. Technical summary The flaw is classified as Broken Access Control (OWASP A1) and is described as a missing authorization issue in the eRoom plugin. The advisory states the required privilege is Subscriber, which implies an authenticated low-privilege user could reach functions they should not. Vulnerable versions are listed as 1.7.1 and earlier (<= 1.7.1), and the patched version is 1.7.2. The advisory does not state a specific workaround beyond updating, and it does not describe detection guidance. Exploitation in the wild is not stated, though the advisory says it is unlikely to be exploited. The CVSS vector string is not stated, only the score of 4.3. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…rability-2?_s_id=cve Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects DigitalME WordPress DigitalME eRoom DigitalME eroom-zoom-meetings-webinar WordPress eRoom Plugin NIST National Vulnerability DatabasePublished Oct 21, 2026 18:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

From the advisory

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects