https://vulnogram.org/ Most recent CVEs assigned by Patchstack (patchstack). https://vulnogram.org/seaview/icons/patchstack.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-112861 https://vulnogram.org/CVE-2026-112861 Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a th… Medium Tue, 20 Oct 2026 17:47:26 GMT https://vulnogram.org/CVE-2026-112823 https://vulnogram.org/CVE-2026-112823 Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25. Medium Tue, 20 Oct 2026 15:14:13 GMT https://vulnogram.org/CVE-2026-112824 https://vulnogram.org/CVE-2026-112824 Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking wit… Medium Network Exploitable Tue, 20 Oct 2026 15:13:47 GMT https://vulnogram.org/CVE-2026-111843 https://vulnogram.org/CVE-2026-111843 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7. Medium Tue, 20 Oct 2026 15:12:05 GMT https://vulnogram.org/CVE-2026-112829 https://vulnogram.org/CVE-2026-112829 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30. Medium Network Exploitable Tue, 20 Oct 2026 15:11:43 GMT https://vulnogram.org/CVE-2026-112840 https://vulnogram.org/CVE-2026-112840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5. Medium Tue, 20 Oct 2026 15:10:54 GMT https://vulnogram.org/CVE-2026-112836 https://vulnogram.org/CVE-2026-112836 Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8. High Network Exploitable Tue, 20 Oct 2026 15:10:13 GMT https://vulnogram.org/CVE-2026-109700 https://vulnogram.org/CVE-2026-109700 Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a th… Medium Tue, 20 Oct 2026 15:06:51 GMT https://vulnogram.org/CVE-2026-112834 https://vulnogram.org/CVE-2026-112834 Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0. Medium Network Exploitable Tue, 20 Oct 2026 14:53:47 GMT https://vulnogram.org/CVE-2026-112833 https://vulnogram.org/CVE-2026-112833 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.… Medium Tue, 20 Oct 2026 14:53:14 GMT https://vulnogram.org/CVE-2026-111844 https://vulnogram.org/CVE-2026-111844 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23. Medium Tue, 20 Oct 2026 09:47:10 GMT https://vulnogram.org/CVE-2026-111828 https://vulnogram.org/CVE-2026-111828 Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5. Medium Mon, 19 Oct 2026 13:29:02 GMT https://vulnogram.org/CVE-2026-112222 https://vulnogram.org/CVE-2026-112222 Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744. Medium Mon, 19 Oct 2026 13:28:19 GMT https://vulnogram.org/CVE-2026-111829 https://vulnogram.org/CVE-2026-111829 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0. Medium Mon, 19 Oct 2026 13:27:57 GMT https://vulnogram.org/CVE-2026-110902 https://vulnogram.org/CVE-2026-110902 Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1. Medium Mon, 19 Oct 2026 13:27:05 GMT https://vulnogram.org/CVE-2026-111845 https://vulnogram.org/CVE-2026-111845 Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a throug… Medium Network Exploitable Mon, 19 Oct 2026 12:38:16 GMT https://vulnogram.org/CVE-2026-111831 https://vulnogram.org/CVE-2026-111831 Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15. Medium Network Exploitable Mon, 19 Oct 2026 12:24:22 GMT https://vulnogram.org/CVE-2026-110363 https://vulnogram.org/CVE-2026-110363 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10. Medium Mon, 19 Oct 2026 12:21:58 GMT https://vulnogram.org/CVE-2026-111836 https://vulnogram.org/CVE-2026-111836 Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentCommunity: from n/a through 2.11.0. Medium Mon, 19 Oct 2026 12:21:27 GMT https://vulnogram.org/CVE-2026-111414 https://vulnogram.org/CVE-2026-111414 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.4. Medium Mon, 19 Oct 2026 12:20:08 GMT https://vulnogram.org/CVE-2026-111410 https://vulnogram.org/CVE-2026-111410 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57. Medium Mon, 19 Oct 2026 12:16:12 GMT https://vulnogram.org/CVE-2026-111839 https://vulnogram.org/CVE-2026-111839 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3… Medium Network Exploitable Mon, 19 Oct 2026 12:13:50 GMT https://vulnogram.org/CVE-2026-112199 https://vulnogram.org/CVE-2026-112199 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1. Medium Mon, 19 Oct 2026 12:06:43 GMT https://vulnogram.org/CVE-2026-110887 https://vulnogram.org/CVE-2026-110887 Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32. Critical Mon, 19 Oct 2026 09:09:19 GMT https://vulnogram.org/CVE-2026-111398 https://vulnogram.org/CVE-2026-111398 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.1. High Mon, 19 Oct 2026 09:09:19 GMT https://vulnogram.org/CVE-2026-110898 https://vulnogram.org/CVE-2026-110898 Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5. Medium Mon, 19 Oct 2026 09:09:19 GMT https://vulnogram.org/CVE-2026-111407 https://vulnogram.org/CVE-2026-111407 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2. Medium Mon, 19 Oct 2026 09:09:19 GMT https://vulnogram.org/CVE-2026-111408 https://vulnogram.org/CVE-2026-111408 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7. High Mon, 19 Oct 2026 09:09:18 GMT https://vulnogram.org/CVE-2026-110379 https://vulnogram.org/CVE-2026-110379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91. High Network Exploitable Mon, 19 Oct 2026 09:09:18 GMT https://vulnogram.org/CVE-2026-111406 https://vulnogram.org/CVE-2026-111406 Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1. Critical Mon, 19 Oct 2026 09:09:18 GMT https://vulnogram.org/CVE-2026-110895 https://vulnogram.org/CVE-2026-110895 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.This issue affects Support Genix: from n/a through 1.4.54. High Sun, 18 Oct 2026 11:00:30 GMT https://vulnogram.org/CVE-2026-107436 https://vulnogram.org/CVE-2026-107436 Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: from n/a through 3.3.12. High Sun, 18 Oct 2026 11:00:30 GMT https://vulnogram.org/CVE-2026-110373 https://vulnogram.org/CVE-2026-110373 Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with phone number: from n/a through 1.8.77. High Network Exploitable Sun, 18 Oct 2026 11:00:30 GMT https://vulnogram.org/CVE-2026-110880 https://vulnogram.org/CVE-2026-110880 Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.6. Medium Network Exploitable Sun, 18 Oct 2026 11:00:30 GMT https://vulnogram.org/CVE-2026-110886 https://vulnogram.org/CVE-2026-110886 Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1. Critical Network Exploitable Sun, 18 Oct 2026 11:00:30 GMT https://vulnogram.org/CVE-2026-109895 https://vulnogram.org/CVE-2026-109895 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29. High Network Exploitable Sun, 18 Oct 2026 11:00:29 GMT https://vulnogram.org/CVE-2026-109894 https://vulnogram.org/CVE-2026-109894 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29. Critical Network Exploitable Sun, 18 Oct 2026 11:00:29 GMT https://vulnogram.org/CVE-2026-110883 https://vulnogram.org/CVE-2026-110883 Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issue affects 2Way VideoCalls and Random Chat: from n/a through 6.1.5. Medium Network Exploitable Sun, 18 Oct 2026 11:00:29 GMT https://vulnogram.org/CVE-2026-110383 https://vulnogram.org/CVE-2026-110383 Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… High Network Exploitable Sun, 18 Oct 2026 11:00:29 GMT https://vulnogram.org/CVE-2026-110897 https://vulnogram.org/CVE-2026-110897 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beave… High Network Exploitable Sun, 18 Oct 2026 11:00:28 GMT https://vulnogram.org/CVE-2026-110372 https://vulnogram.org/CVE-2026-110372 Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40. Critical Known Exploited Network Exploitable Sun, 18 Oct 2026 11:00:28 GMT https://vulnogram.org/CVE-2026-110382 https://vulnogram.org/CVE-2026-110382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Stored XSS.This issue affects Simply Schedule Appointments: from n/a throu… High Network Exploitable Sun, 18 Oct 2026 11:00:28 GMT https://vulnogram.org/CVE-2026-108485 https://vulnogram.org/CVE-2026-108485 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13. High Network Exploitable Sun, 18 Oct 2026 11:00:28 GMT https://vulnogram.org/CVE-2026-110885 https://vulnogram.org/CVE-2026-110885 Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a through 1.7.32. Medium Sun, 18 Oct 2026 11:00:22 GMT https://vulnogram.org/CVE-2026-110365 https://vulnogram.org/CVE-2026-110365 Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced File Manager: from n/a through 5.4.14. Medium Network Exploitable Sun, 18 Oct 2026 11:00:22 GMT https://vulnogram.org/CVE-2026-110882 https://vulnogram.org/CVE-2026-110882 Missing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a throu… Medium Sat, 17 Oct 2026 19:00:11 GMT https://vulnogram.org/CVE-2026-109701 https://vulnogram.org/CVE-2026-109701 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45. High Network Exploitable Sat, 17 Oct 2026 17:00:45 GMT https://vulnogram.org/CVE-2026-110889 https://vulnogram.org/CVE-2026-110889 Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4. High Network Exploitable Sat, 17 Oct 2026 11:00:12 GMT https://vulnogram.org/CVE-2026-110384 https://vulnogram.org/CVE-2026-110384 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through… High Network Exploitable Sat, 17 Oct 2026 07:00:31 GMT https://vulnogram.org/CVE-2026-111413 https://vulnogram.org/CVE-2026-111413 Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery.This issue affects aThemeArt Theme Helper: from n/a through 1.0.8. High Network Exploitable Fri, 16 Oct 2026 13:02:14 GMT