Search
105 CVEs · published 2026-10-17 to 2026-10-17
CVEs (105)
Showing 1–25 of 105
| CVE ID ↑ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2024-58398 | MEDIUM | Patched | 4.3 | 2026-10-17 | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is … |
| CVE-2025-71435 | LOW | Patched | 4.2 | 2026-10-17 | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is iss… |
| CVE-2026-100316 | HIGH | 7.2 | 2026-10-17 | The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and i… | |
| CVE-2026-103376 | MEDIUM | Patched | 5.3 | 2026-10-17 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any capab… |
| CVE-2026-103899 | HIGH | 7.2 | 2026-10-17 | The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and including, … | |
| CVE-2026-104122 | MEDIUM | 6.8 | 2026-10-17 | The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and abov… | |
| CVE-2026-104246 | MEDIUM | 5.9 | 2026-10-17 | The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unaut… | |
| CVE-2026-104734 | HIGH | 7.2 | 2026-10-17 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via d… | |
| CVE-2026-104736 | CRITICAL | 9.8 | 2026-10-17 | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout… | |
| CVE-2026-105391 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-106470 | MEDIUM | Patched | 5.0 | 2026-10-17 | The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber,… |
| CVE-2026-107274 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-107345 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-107744 | MEDIUM | 6.5 | 2026-10-17 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.… | |
| CVE-2026-107752 | MEDIUM | 4.9 | 2026-10-17 | The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / searchSkuSql)' parameter in all vers… | |
| CVE-2026-107762 | HIGH | 7.5 | 2026-10-17 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,… | |
| CVE-2026-107763 | MEDIUM | 4.3 | 2026-10-17 | The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly veri… | |
| CVE-2026-107772 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-108117 | NONE | — | 2026-10-17 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-108123 | HIGH | 7.5 | 2026-10-17 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin … | |
| CVE-2026-109208 | HIGH | 7.2 | 2026-10-17 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_… | |
| CVE-2026-109368 | MEDIUM | 6.5 | 2026-10-17 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0.3 via the 'id' par… | |
| CVE-2026-109369 | MEDIUM | 6.8 | 2026-10-17 | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin … | |
| CVE-2026-109701 | HIGH | 7.1 | 2026-10-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflec… | |
| CVE-2026-109983 | MEDIUM | 6.4 | 2026-10-17 | The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due … |