Skip to content
Fencer Intel

Latest vulnerabilities

Newest first, late arrivals on top. Also a feed.

  1. 7.2
    CVE-2026-110776 MDTF <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter
    WordPress
  2. 7.2
    CVE-2026-87964 Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter
    WordPress
  3. 6.4
    CVE-2026-120550 WP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta
    WordPress
  4. 8.7
    CVE-2026-123087 SQL injection in Atmira’s SIREC
  5. 2.0
    CVE-2026-103682 Jolokia special agent exposes password in process list
  6. 2.0
    CVE-2026-103674 NetApp ONTAP special agent exposes password in process list
  7. 7.4
    CVE-2026-125758 Aptabase before commit 61d4c01 Authentication Bypass via Known Example AUTH_SECRET
    maintainer advisory
  8. 5.3
    CVE-2026-123660 Vulnerability-Lookup: memory amplification through webhook payload template format specifiers
  9. 6.4
    CVE-2026-122222 Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug
    WordPress
  10. 6.5
    CVE-2026-121794 Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen
    WordPress
  11. 6.4
    CVE-2026-118189 Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
    WordPress
  12. 7.2
    CVE-2026-110291 Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings
    WordPress
  13. 6.4
    CVE-2026-120671 UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute
    WordPress
  14. 7.5
    CVE-2026-19877 Brute-forceable image-share link password in INFINITT ULite
  15. 6.1
    CVE-2026-19876 Reflected XSS in INFINITT ULite login error page (pre-auth)
  16. 6.3
    CVE-2026-108018 BigFix Mobile is affected by sensitive information disclosure
  17. 8.1
    CVE-2026-125358 Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink
    maintainer advisory
  18. 9.8
    CVE-2026-119516 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability
    WordPress
  19. 6.5
    CVE-2026-119472 WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability
    WordPress
  20. 9.8
    CVE-2026-120844 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability
    WordPress
  21. 7.1
    CVE-2026-39744 WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability
    WordPress
  22. 7.1
    CVE-2026-119488 WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability
    WordPress
  23. 7.5
    CVE-2026-119499 WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability
    WordPress
  24. 6.3
    CVE-2026-65022 BigFix Mobile is affected by a Cross-site scripting vulnerability
  25. 7.5
    CVE-2026-121006 HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time
  26. 5.3
    CVE-2026-121636 Quick Event Manager 9.9.5 - 9.18 - Unauthenticated PayPal IPN Verification Bypass via the 'debug' Parameter
    WordPress
  27. 5.3
    CVE-2026-121633 Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Listener
    WordPress
  28. 4.8
    CVE-2026-118166 MC4WP: Mailchimp for WordPress < 4.15.0 - Unauthenticated Arbitrary Shortcode Execution via Dynamic Content Tag
    WordPress
  29. 10.0
    CVE-2026-118423 WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload
    WordPress
  30. 8.0
    CVE-2026-88801 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation
    WordPress