cve.li

Recent

CVE-2026-6424CWE-416

Use-after-free vulnerability in ESET security products for Linux

Published 2026-07-16 by ESET

CVE-2026-15324CWE-79

SysBasics Customize My Account for WooCommerce <= 4.4.14 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter

Published 2026-07-16 by Wordfence

CVE-2026-15103CWE-269

WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter

Published 2026-07-16 by Wordfence

CVE-2026-15727CWE-89

WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter

Published 2026-07-16 by Wordfence

CVE-2026-15021CWE-79

wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field

Published 2026-07-16 by Wordfence

CVE-2026-15005CWE-352

Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter

Published 2026-07-16 by Wordfence

CVE-2026-13741CWE-269

Digits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter

Published 2026-07-16 by Wordfence

CVE-2026-58078CWE-89

Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1

Published 2026-07-16 by Joomla

CVE-2026-6423CWE-269

Local privilege escalation via unauthenticated ALPC in ESET Inspect Connector

Published 2026-07-16 by ESET

CVE-2026-13755CWE-79

Tickera <= 3.6.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute

Published 2026-07-16 by Wordfence

CVE-2026-15610CWE-862

WPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function

Published 2026-07-16 by Wordfence

CVE-2026-15106CWE-862

WPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter

Published 2026-07-16 by Wordfence

CVE-2026-15407CWE-862

Themify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action

Published 2026-07-16 by Wordfence

CVE-2026-15651CWE-89

WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter

Published 2026-07-16 by Wordfence

CVE-2026-15008CWE-502

Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

Published 2026-07-16 by Wordfence

CVE-2026-15022CWE-89

Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array

Published 2026-07-16 by Wordfence

CVE-2026-13754CWE-89

Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter

Published 2026-07-16 by Wordfence

CVE-2026-7543CWE-79

Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details

Published 2026-07-16 by Wordfence

CVE-2026-13767CWE-89

Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter

Published 2026-07-16 by Wordfence

CVE-2026-15350CWE-862

The Cache Purger <= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter

Published 2026-07-16 by Wordfence

Load more ↓