CVE-2026-66688 - WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-66688
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66688
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66690 - WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-66690
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66690
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66692 - WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability
CVE ID :CVE-2026-66692
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66692
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66694 - WordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-66694
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66694
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66695 - WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability
CVE ID :CVE-2026-66695
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66695
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66696 - WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability
CVE ID :CVE-2026-66696
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66696
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66699 - WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability
CVE ID :CVE-2026-66699
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Custom role Broken Access Control in Dokan <= 5.0.10 versions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66699
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Custom role Broken Access Control in Dokan <= 5.0.10 versions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66701 - WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability
CVE ID :CVE-2026-66701
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66701
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66702 - WordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-66702
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66702
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66703 - WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-66703
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66703
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66705 - WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-66705
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66705
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66706 - WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-66706
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66706
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66707 - WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-66707
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66707
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66708 - WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability
CVE ID :CVE-2026-66708
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66708
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66709 - WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability
CVE ID :CVE-2026-66709
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66709
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66710 - WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability
CVE ID :CVE-2026-66710
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66710
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66711 - WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability
CVE ID :CVE-2026-66711
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66711
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66712 - WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability
CVE ID :CVE-2026-66712
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66712
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-67261 - Dell Virtual Storage Integrator OS Command Injection Vulnerability
CVE ID :CVE-2026-67261
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying operating system with root privileges. Exploitation may lead to a complete system takeover by an attacker. This vulnerability is considered critical as it allows an unauthenticated remote attacker to achieve arbitrary code execution as root, potentially compromising the entire VSI deployment and underlying infrastructure. Dell recommends customers to upgrade at the earliest opportunity.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-67261
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying operating system with root privileges. Exploitation may lead to a complete system takeover by an attacker. This vulnerability is considered critical as it allows an unauthenticated remote attacker to achieve arbitrary code execution as root, potentially compromising the entire VSI deployment and underlying infrastructure. Dell recommends customers to upgrade at the earliest opportunity.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-70637 - LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c
CVE ID :CVE-2026-70637
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-70637
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-70646 - aiosend: Deserialization of request body before signature verification (Pre-auth DoS) in webhook handler
CVE ID :CVE-2026-70646
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-70646
Published : Aug. 6, 2026, 3:17 p.m. | 51 minutes ago
Description :aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...