PATCHBAY / PUBLICThreat News
Appearance
Color mode

Stronger text, borders, and focus indicators. Works with either color mode.

Online

THE LATEST / SECURITY & VULNERABILITIES

Threat News

Recent vulnerabilities and security advisories, straight from the source.

The complete recent NVD stream, including unscored entries. All entries link to the original publisher.

For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.

17,017 stories · Past 30 days · Newest first

Subscribe to this view · RSS
Source updates

Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.

  1. NVD

    CVE-2026-94360 — The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed.

    CVE-2026-94360
    Read original (opens in a new tab)
  2. NVD

    CVE-2026-94261 — The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it i…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.

    CVE-2026-94261
    Read original (opens in a new tab)
  3. NVD

    CVE-2026-94260 — The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated whe…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state.

    CVE-2026-94260
    Read original (opens in a new tab)
  4. NVD

    CVE-2026-94254 — The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated dur…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their own choosing.

    CVE-2026-94254
    Read original (opens in a new tab)
  5. NVD

    CVE-2026-92426 — The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleti…

    Medium · CVSS 3.1 4.9 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contributor role and above to delete arbitrary post meta from any post, including content owned by higher-privileged users.

    CVE-2026-92426
    Read original (opens in a new tab)
  6. NVD

    CVE-2026-92409 — The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute befor…

    Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page is viewed.

    CVE-2026-92409
    Read original (opens in a new tab)
  7. NVD

    CVE-2026-91076 — The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force any WooCommerce order into a failed state. Order identifiers are sequential, so every order in the shop can be taken out of the fulfilment queue one request at a time.

    CVE-2026-91076
    Read original (opens in a new tab)
  8. NVD

    CVE-2026-90989 — The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capabilit…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.

    CVE-2026-90989
    Read original (opens in a new tab)
  9. NVD

    CVE-2026-89310 — A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a…

    Critical · CVSS 4.0 9.4 · Assessor: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158

    A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account.

    CVE-2026-89310
    Read original (opens in a new tab)
  10. NVD

    CVE-2026-89288 — The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an una…

    High · CVSS 3.1 8.6 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

    CVE-2026-89288
    Read original (opens in a new tab)
  11. NVD

    CVE-2026-88927 — The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may wri…

    Medium · CVSS 3.1 4.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's private album and have it attributed to that user.

    CVE-2026-88927
    Read original (opens in a new tab)
  12. NVD

    CVE-2026-87974 — The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, acceptin…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers to mark arbitrary orders as paid.

    CVE-2026-87974
    Read original (opens in a new tab)
  13. NVD

    CVE-2026-87968 — The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin befor…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visitor can force the store to re-register and overwrite the Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2's stored shop secret.

    CVE-2026-87968
    Read original (opens in a new tab)
  14. NVD

    CVE-2026-87843 — The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment pro…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made, and to retrieve order and customer details.

    CVE-2026-87843
    Read original (opens in a new tab)
  15. NVD

    CVE-2026-86799 — The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputtin…

    High · CVSS 3.1 8.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.

    CVE-2026-86799
    Read original (opens in a new tab)
  16. NVD

    CVE-2026-86797 — The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blo…

    Medium · CVSS 3.1 6.8 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users with contributor-level access and above to store malicious scripts that execute when another user views and interacts with the affected content.

    CVE-2026-86797
    Read original (opens in a new tab)
  17. NVD

    CVE-2026-86787 — The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body th…

    High · CVSS 3.1 7.2 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

    CVE-2026-86787
    Read original (opens in a new tab)
  18. NVD

    CVE-2026-85345 — The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before per…

    Medium · CVSS 3.1 4.1 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The FV Flowplayer Video Player WordPress plugin before 7.5.55.7212 does not properly validate a user-supplied URL before performing a server-side fetch, and an existing host-based restriction fails to cover all cases, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks. The impact is limited to a semi-blind oracle: the server's fetch reveals whether an internal resource responds and its HTTP status, but the resource's contents are not returned to the attacke…

    CVE-2026-85345
    Read original (opens in a new tab)
  19. NVD

    CVE-2026-85000 — The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request th…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-bearing request to a third-party API and stores attacker-controlled cache entries, allowing unauthenticated attackers to consume the site owner's third-party API quota and write unbounded records into the site's database.

    CVE-2026-85000
    Read original (opens in a new tab)
  23. NVD

    CVE-2026-108069 — The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted g…

    Medium · CVSS 3.1 5.3 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).

    CVE-2026-108069
    Read original (opens in a new tab)
  24. NVD

    CVE-2026-108066 — The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-fact…

    Low · CVSS 3.1 2.7 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.

    CVE-2026-108066
    Read original (opens in a new tab)
  25. NVD

    CVE-2026-108064 — The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that d…

    Medium · CVSS 3.1 6.5 · Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0

    The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance.

    CVE-2026-108064
    Read original (opens in a new tab)

Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.