The archive.

Tomdever1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2026-49767 · Tomdever wpForo Forum

WordPress wpForo Forum plugin <= 3.1.0 - Broken Authentication vulnerability

A WP Life1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-39589 · A WP Life Webenvo

WordPress Webenvo theme <= 0.0.6 - Arbitrary File Upload vulnerability

Extendons1 vulnerability on this pageMax CVSS 10.0Priority 38KEV 0

CVE-2025-69129 · Extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site

WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerability

EPSS 0.4%CVSS 10.0

Jetimpex Inc.6 vulnerabilities on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-52706 · Jetimpex Inc. JetEngine

WordPress JetEngine plugin <= 3.8.10 - PHP Object Injection vulnerability

CVE-2026-49075 · Jetimpex Inc. JetEngine

WordPress JetEngine plugin <= 3.8.9.1 - PHP Object Injection vulnerability

CVE-2026-48875 · Jetimpex Inc. JetSmartFilters

WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability

CVE-2026-49079 · Jetimpex Inc. JetSearch

WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability

CVE-2026-49084 · Jetimpex Inc. JetEngine

WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability

CVE-2026-54187 · Jetimpex Inc. JetEngine

WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability

jwsthemes1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2026-42380 · jwsthemes AI Lab

WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability

ThemeREX Group1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2025-60205 · ThemeREX Group ThemeREX Addons

WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability

WPLocker1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2025-60218 · WPLocker PT Luxa Addons

WordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Upload Vulnerability

Zidithemes1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2024-52488 · Zidithemes Grip

WordPress Grip theme <= 1.0.9 - Arbitrary Plugin Activation/Deactivation to RCE vulnerability

EPSS 0.5%CVSS 9.9

Zozothemes1 vulnerability on this pageMax CVSS 9.9Priority 38KEV 0

CVE-2026-22327 · Zozothemes Restaurt

WordPress Restaurt theme <= 1.0.4 - Arbitrary File Upload vulnerability

EPSS 0.5%CVSS 9.9

Cozy Vision Technologies Pvt. Ltd.1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2026-54803 · Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications

WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability

HCL Software1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-59872 · HCL Software ZIE

HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability,

themagnifico524 vulnerabilities on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2026-40746 · themagnifico52 Restaurant Zone

WordPress Restaurant Zone theme <= 0.7.8 - Arbitrary File Upload vulnerability

CVE-2026-40747 · themagnifico52 Ecommerce Zone

WordPress Ecommerce Zone theme <= 0.9.7 - Arbitrary File Upload vulnerability

CVE-2026-40748 · themagnifico52 Kids Gift Shop

WordPress Kids Gift Shop theme <= 0.5.4 - Arbitrary File Upload vulnerability

CVE-2026-40749 · themagnifico52 Charity Zone

WordPress Charity Zone theme <= 1.1.1 - Arbitrary File Upload vulnerability

Theme passion1 vulnerability on this pageMax CVSS 9.8Priority 37KEV 0

CVE-2025-69179 · Theme passion Support Ticket Management System

WordPress Support Ticket Management System plugin <= 1.9 - Privilege Escalation vulnerability

WishList Products, LLC.1 vulnerability on this pageMax CVSS 9.9Priority 37KEV 0

CVE-2026-25446 · WishList Products, LLC. WishList Member X

WordPress WishList Member X plugin <= 3.29.0 - Arbitrary File Upload vulnerability

Apache Software Foundation2 vulnerabilities on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-32966 · Apache Software Foundation Apache DolphinScheduler

Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

CVE-2026-32967 · Apache Software Foundation Apache DolphinScheduler

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

EPSS 0.3%CVSS 9.1

Barn2 Media Ltd1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-40725 · Barn2 Media Ltd WooCommerce Product Filters

WordPress WooCommerce Product Filters plugin < 2.0.6 - PHP Object Injection vulnerability

Thrive Themes1 vulnerability on this pageMax CVSS 9.8Priority 36KEV 0

CVE-2026-49107 · Thrive Themes Thrive Apprentice

WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability

Advanced Ads GmbH1 vulnerability on this pageMax CVSS 9.3Priority 35KEV 0

CVE-2025-59554 · Advanced Ads GmbH Advanced Ads – Tracking

WordPress Advanced Ads – Tracking plugin < 3.0.7 - SQL Injection vulnerability

LoginPress1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-49058 · LoginPress LoginPress Pro

WordPress LoginPress Pro plugin <= 6.2.2 - Privilege Escalation vulnerability

EPSS 0.3%CVSS 9.8

Studio Keren Aga LTD.1 vulnerability on this pageMax CVSS 9.9Priority 35KEV 0

CVE-2026-27041 · Studio Keren Aga LTD. Unlimited Elements for Elementor (Premium)

WordPress Unlimited Elements for Elementor (Premium) plugin <= 2.0.6 - Arbitrary File Upload vulnerability

EPSS 0.3%CVSS 9.9

ThemeGrill1 vulnerability on this pageMax CVSS 9.8Priority 35KEV 0

CVE-2026-54807 · ThemeGrill Registration Form for WooCommerce

WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability

EPSS 0.3%CVSS 9.8

WPMet1 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2026-24611 · WPMet MetForm Pro

WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability

EPSS 0.4%CVSS 9.1

Crocoblock1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-49076 · Crocoblock JetEngine

WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability

Jobster Marketplace1 vulnerability on this pageMax CVSS 9.3Priority 34KEV 0

CVE-2026-22340 · Jobster Marketplace WPJobster

WordPress WPJobster theme <= 6.3.5 - SQL Injection vulnerability

Android1 vulnerability on this pageMax CVSS 10.0Priority 33KEV 0

CVE-2026-28576 · Android Android

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection.

eyecix1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-54186 · eyecix JobSearch

WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability

Themeum1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-22332 · Themeum Tutor LMS Pro

WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability

Tips and Tricks HQ1 vulnerability on this pageMax CVSS 9.3Priority 32KEV 0

CVE-2026-54811 · Tips and Tricks HQ WP eMember

WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability

BDthemes1 vulnerability on this pageMax CVSS 9.0Priority 31KEV 0

CVE-2026-52705 · BDthemes SigmaForms Pro – AI Generated Forms

WordPress SigmaForms Pro – AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload vulnerability

EPSS 0.3%CVSS 9.0

Google9 vulnerabilities on this pageMax CVSS 10.0Priority 31KEV 0

CVE-2026-0063 · Google Android

In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the…

CVE-2026-0071 · Google Android

In SettingsLib, there is a possible missing permission check due to a logic error in the code.

CVE-2026-0081 · Google Android

In NFC, there is a possible way to spoof an NFC event due to a missing permission check.

CVE-2026-0082 · Google Android

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure defa…

CVE-2026-0064 · Google Android

In multiple places, there is a possible persistent denial of service due to resource exhaustion.

CVE-2026-0083 · Google Android

In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition.

CVE-2026-28575 · Google Android

In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a…

CVE-2026-28587 · Google Android

In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check.

CVE-2026-28615 · Google Android

In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass.