Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 5.4
    CVE-2026-119218 Greenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix
    WordPress
  2. 5.4
    CVE-2026-120741 MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint
    WordPress
  3. 6.4
    CVE-2026-115816 Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review
    WordPress
  4. 7.2
    CVE-2026-119175 Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content
    WordPress
  5. 5.4
    CVE-2026-121515 FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content
    WordPress
  6. 8.8
    CVE-2026-104913 Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json
    WordPress
  7. 5.4
    CVE-2026-118067 Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter
    WordPress
  8. 6.4
    CVE-2026-119165 WPBakery Page Builder <= 9.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Post Author Display Name
    WordPress
  9. 5.4
    CVE-2026-119152 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field
    WordPress
  10. 3.7
    CVE-2026-119213 Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed
    WordPress
  11. 6.4
    CVE-2026-119098 LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer
    WordPress
  12. 5.3
    CVE-2026-120555 Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter
    WordPress
  13. 5.9
    CVE-2026-119616 Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name
    WordPress
  14. 6.4
    CVE-2026-121519 Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter
    WordPress
  15. 5.9
    CVE-2026-120737 Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter
    WordPress
  16. 7.2
    CVE-2026-120082 GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content
    WordPress
  17. 5.3
    CVE-2026-120520 Greenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter
    WordPress
  18. 5.4
    CVE-2026-119219 Jupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta
    WordPress
  19. 6.4
    CVE-2026-118046 JS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title
    WordPress
  20. 7.2
    CVE-2026-119070 Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer
    WordPress
  21. 6.4
    CVE-2026-118054 LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter
    WordPress
  22. 6.4
    CVE-2026-116562 Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter
    WordPress
  23. 9.8
    CVE-2026-93754 payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution
    WordPress
  24. 7.2
    CVE-2026-120512 Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value
    WordPress
  25. 8.1
    CVE-2026-124001 ION-DTN 2.2.1b-4.2.0 Integer Overflow Heap Corruption via DGR
    maintainer advisory
  26. 5.3
    CVE-2026-124000 ION-DTN 2.1.0-4.2.0 Heap Buffer Under-allocation DoS in amsd
    maintainer advisory
  27. 7.5
    CVE-2026-123999 ION-DTN 3.6.2-4.2.0 Heap Buffer Overflow via nm_mgr AMP Rendering
    maintainer advisory
  28. 7.5
    GHSA-6rgc-8hxm-rj7p Segmentation fault when hashing, comparing, or printing a cyclic CBORTag decoded from untrusted CBOR (regression of the 5.6.2 recursive-hash fix)
    pypi unreviewed · maintainers only
  29. 4.8
    CVE-2026-71881 Cross-site scripting in Integrated Publishing Toolkit
  30. 10.0
    CVE-2026-109469 Entra Device Registration Elevation of Privilege Vulnerability