Publikacje w kolejności czasu

Wszystkie technologie

Szukaj CVE lub produktu Publikacja CVEKolejność

Podatności: nazwa, oprogramowanie, krótki opis, CVSS, EPSS i KEV.
Oprogramowanie	Podatność i krótki opis
CMB2	CVE-2026-116761 Pozostałe The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This…	5,4	0,22 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Mang Board	CVE-2026-110071 Pozostałe The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and…	6,4	0,2 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More	CVE-2026-110185 Pozostałe The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image (any body field referenced by the ImageHelper node's mix tag)' parameter…	5,9	0,55 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
MxChat – AI Chatbot & Content Generation for WordPress	CVE-2026-110662 Monitoruj The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for…	7,2	0,31 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
DesignSetGo	CVE-2026-111068 Pozostałe The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access…	4,4	0,21 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons	CVE-2026-111111 Monitoruj The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it…	7,2	0,24 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
VikRentCar Car Rental Management System	CVE-2026-111120 Monitoruj The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible for unauthenticated attackers…	8,8	0,32 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Travelly – Tour & Travel Booking Manager for WooCommerce	CVE-2026-111213 Pozostałe The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for…	4,3	0,22 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions	CVE-2026-109972 Pozostałe The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization…	6,4	0,27 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Cozy Blocks – Website Builder & Business Growth Toolkit \| Popups, Lead Forms & Inbox	CVE-2026-109975 Pozostałe The Cozy Blocks – Website Builder for WordPress Block Editor \| Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content (block attribute icon.view / icon.layout / icon.gap)' parameter in all versions up to, and including, 2.2.27 due…	6,4	0,2 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Cozy Blocks – Website Builder & Business Growth Toolkit \| Popups, Lead Forms & Inbox	CVE-2026-109978 Pozostałe The Cozy Blocks – Website Builder for WordPress Block Editor \| Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'productRating.iconColor' parameter in all versions up to, and including, 2.2.27 due to insufficient input sanitization…	6,4	0,24 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Related Posts for WordPress	CVE-2026-109979 Pozostałe The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wp_create_link' parameter of the hidden 'rp4wp_link_related' admin page. The handle_create_link() handler verifies the nonce and that the current…	4,3	0,3 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Related Posts for WordPress	CVE-2026-109980 Pozostałe The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wp_view' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and…	4,3	0,22 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Product Addons for Woocommerce – Product Options with Custom Fields	CVE-2026-109988 Pozostałe The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields[section][fields][row][col][type]' parameter in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output…	4,4	0,21 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Rich Showcase for Google Reviews	CVE-2026-110020 Pozostałe The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.1.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with…	6,5	0,38 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Contact Manager	CVE-2026-109218 Wysoki priorytet The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation…	9,8	0,64 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Document Embedder – let visitors read files without downloading	CVE-2026-109370 Pozostałe The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content (post_content containing block JSON documentSource.doc)' parameter in all versions up to, and including, 2.4.0 due to insufficient input…	6,4	0,22 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar	CVE-2026-109381 Monitoruj The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker…	7,2	0,43 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
The Innovative Form Builder – IvyForms	CVE-2026-109384 Monitoruj The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence of a dangerous-extension denylist in the…	8,8	0,73 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks	CVE-2026-109385 Pozostałe The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][slot_{N}_link][url]' parameter in all versions up to, and including, 5.3.0 due to…	6,4	0,26 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Travelly – Tour & Travel Booking Manager for WooCommerce	CVE-2026-109590 Pozostałe The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the [ttbm-hotel-map] shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user…	6,4	0,24 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Awesome Support – WordPress HelpDesk & Support Plugin	CVE-2026-103370 Pozostałe The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for…	6,4	0,26 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
If-So Dynamic Content – Elementor & All Page Builders Personalization	CVE-2026-103996 Pozostałe The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for…	6,4	0,24 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
Avada (Fusion) Builder	CVE-2026-104729 Pozostałe The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_notice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…	6,4	0,16 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków
If-So Dynamic Content – Elementor & All Page Builders Personalization	CVE-2026-104740 Pozostałe The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'conversion' Shortcode Attribute in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it…	6,4	0,24 %13 lis 2026	Brak wpisu w KEV nie wyklucza ataków

Źródła i pokrycie danych

Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.

Ostatnio zakończone okno publikacji NVD: 13.11.2026, 15:09 UTC – 13.11.2026, 20:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.

NVD · publikacjeOstatnie przetworzenie zakończone13.11.2026, 20:08 UTC

NVD · aktualizacjeOstatnie przetworzenie zakończone13.11.2026, 20:09 UTC

CISA KEVOstatnie przetworzenie zakończone13.11.2026, 21:15 UTC

FIRST EPSSOstatnie przetworzenie zakończone13.11.2026, 16:24 UTCData oceny znajduje się przy rekordzie. Codziennie: KEV i publikacje z 30 dni; pozostałe CVE: raz w tygodniu.