https://exploit-db.ai/cve AI-scored CVE & exploit intelligence. Data: NVD. Analysis: local $0 model. Wed, 30 Sep 2026 09:29:55 GMT https://exploit-db.ai/cve/CVE-2026-97150 CVE-2026-97150 Wed, 30 Sep 2026 12:16:36 GMT When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user. https://exploit-db.ai/cve/CVE-2026-93464 CVE-2026-93464 Wed, 30 Sep 2026 12:16:36 GMT Stored Cross-Site Scripting via custom content descriptions vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused. https://exploit-db.ai/cve/CVE-2026-93463 CVE-2026-93463 Wed, 30 Sep 2026 12:16:35 GMT Cross-Site Scripting via Script Validation Bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused. https://exploit-db.ai/cve/CVE-2026-93462 CVE-2026-93462 Wed, 30 Sep 2026 12:16:35 GMT Missing authentication for critical function vulnerability exists in baserCMS . If a remote unauthenticated attacker there is a possibility that sensitive information could be obtained. https://exploit-db.ai/cve/CVE-2026-93460 CVE-2026-93460 Wed, 30 Sep 2026 12:16:35 GMT Stored Cross-site scripting via appended strings in email form fields vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused. https://exploit-db.ai/cve/CVE-2026-92873 CVE-2026-92873 Wed, 30 Sep 2026 12:16:35 GMT Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an unauthenticated attacker to promote an arbitrary watchdog node to the leader node. https://exploit-db.ai/cve/CVE-2026-92872 CVE-2026-92872 Wed, 30 Sep 2026 12:16:35 GMT Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information. https://exploit-db.ai/cve/CVE-2026-92871 CVE-2026-92871 Wed, 30 Sep 2026 12:16:35 GMT A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of the watchdog process. https://exploit-db.ai/cve/CVE-2026-92870 CVE-2026-92870 Wed, 30 Sep 2026 12:16:35 GMT A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termination. https://exploit-db.ai/cve/CVE-2026-92869 CVE-2026-92869 Wed, 30 Sep 2026 12:16:34 GMT An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination. https://exploit-db.ai/cve/CVE-2026-92868 CVE-2026-92868 Wed, 30 Sep 2026 12:16:34 GMT An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certificate authentication. https://exploit-db.ai/cve/CVE-2026-92867 CVE-2026-92867 Wed, 30 Sep 2026 12:16:34 GMT An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution. https://exploit-db.ai/cve/CVE-2026-88037 CVE-2026-88037 Wed, 30 Sep 2026 12:16:34 GMT The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes i https://exploit-db.ai/cve/CVE-2026-6806 CVE-2026-6806 Wed, 30 Sep 2026 12:16:34 GMT The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati https://exploit-db.ai/cve/CVE-2026-6173 CVE-2026-6173 Wed, 30 Sep 2026 12:16:33 GMT The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. Thi https://exploit-db.ai/cve/CVE-2026-6172 CVE-2026-6172 Wed, 30 Sep 2026 12:16:33 GMT The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it https://exploit-db.ai/cve/CVE-2026-6171 CVE-2026-6171 Wed, 30 Sep 2026 12:16:33 GMT The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it po https://exploit-db.ai/cve/CVE-2026-6170 CVE-2026-6170 Wed, 30 Sep 2026 12:16:33 GMT The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This m https://exploit-db.ai/cve/CVE-2026-16596 CVE-2026-16596 Wed, 30 Sep 2026 12:16:32 GMT The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it po https://exploit-db.ai/cve/CVE-2026-14876 CVE-2026-14876 Wed, 30 Sep 2026 12:16:32 GMT The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acc https://exploit-db.ai/cve/CVE-2026-11895 CVE-2026-11895 Wed, 30 Sep 2026 12:16:32 GMT The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it pos https://exploit-db.ai/cve/CVE-2026-102508 CVE-2026-102508 Wed, 30 Sep 2026 12:16:31 GMT Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker in a network position between client and server to impersonate the OPC UA server and to read, forge or modify secure-channel traffic, including user cr https://exploit-db.ai/cve/CVE-2026-97196 CVE-2026-97196 Wed, 30 Sep 2026 11:16:31 GMT This vulnerability allows for authentication bypass due to improper validation of unsafe equivalence in input, impacting GiveWP versions from n/a through 4.16.9. https://exploit-db.ai/cve/CVE-2026-89294 CVE-2026-89294 Wed, 30 Sep 2026 11:16:30 GMT The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arb https://exploit-db.ai/cve/CVE-2026-97316 CVE-2026-97316 Wed, 30 Sep 2026 10:17:11 GMT The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services. https://exploit-db.ai/cve/CVE-2026-96886 CVE-2026-96886 Wed, 30 Sep 2026 10:17:10 GMT The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course. https://exploit-db.ai/cve/CVE-2026-94297 CVE-2026-94297 Wed, 30 Sep 2026 10:17:10 GMT The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the https://exploit-db.ai/cve/CVE-2026-94274 CVE-2026-94274 Wed, 30 Sep 2026 10:17:10 GMT The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content. https://exploit-db.ai/cve/CVE-2026-93580 CVE-2026-93580 Wed, 30 Sep 2026 10:17:10 GMT The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment https://exploit-db.ai/cve/CVE-2026-92994 CVE-2026-92994 Wed, 30 Sep 2026 10:17:09 GMT The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript tha https://exploit-db.ai/cve/CVE-2026-92424 CVE-2026-92424 Wed, 30 Sep 2026 10:17:09 GMT The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above https://exploit-db.ai/cve/CVE-2026-91832 CVE-2026-91832 Wed, 30 Sep 2026 10:17:09 GMT The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output une https://exploit-db.ai/cve/CVE-2026-91072 CVE-2026-91072 Wed, 30 Sep 2026 10:17:09 GMT The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a https://exploit-db.ai/cve/CVE-2026-91051 CVE-2026-91051 Wed, 30 Sep 2026 10:17:09 GMT The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code https://exploit-db.ai/cve/CVE-2026-90953 CVE-2026-90953 Wed, 30 Sep 2026 10:17:08 GMT The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators. https://exploit-db.ai/cve/CVE-2026-89193 CVE-2026-89193 Wed, 30 Sep 2026 10:17:08 GMT The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting https://exploit-db.ai/cve/CVE-2026-89190 CVE-2026-89190 Wed, 30 Sep 2026 10:17:08 GMT The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and https://exploit-db.ai/cve/CVE-2026-88797 CVE-2026-88797 Wed, 30 Sep 2026 10:17:07 GMT The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository. https://exploit-db.ai/cve/CVE-2026-88791 CVE-2026-88791 Wed, 30 Sep 2026 10:17:07 GMT The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path. https://exploit-db.ai/cve/CVE-2026-87777 CVE-2026-87777 Wed, 30 Sep 2026 10:17:07 GMT The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens t https://exploit-db.ai/cve/CVE-2026-86789 CVE-2026-86789 Wed, 30 Sep 2026 10:17:07 GMT The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending mod https://exploit-db.ai/cve/CVE-2026-85576 CVE-2026-85576 Wed, 30 Sep 2026 10:17:06 GMT The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them. https://exploit-db.ai/cve/CVE-2026-85573 CVE-2026-85573 Wed, 30 Sep 2026 10:17:06 GMT The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin https://exploit-db.ai/cve/CVE-2026-85415 CVE-2026-85415 Wed, 30 Sep 2026 10:17:06 GMT The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link (such as a https://exploit-db.ai/cve/CVE-2026-85001 CVE-2026-85001 Wed, 30 Sep 2026 10:17:05 GMT The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed. https://exploit-db.ai/cve/CVE-2026-83560 CVE-2026-83560 Wed, 30 Sep 2026 10:17:05 GMT The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered use https://exploit-db.ai/cve/CVE-2026-82127 CVE-2026-82127 Wed, 30 Sep 2026 10:17:05 GMT The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged https://exploit-db.ai/cve/CVE-2026-80333 CVE-2026-80333 Wed, 30 Sep 2026 10:17:05 GMT The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve. https://exploit-db.ai/cve/CVE-2026-75873 CVE-2026-75873 Wed, 30 Sep 2026 10:17:04 GMT The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution. https://exploit-db.ai/cve/CVE-2026-75824 CVE-2026-75824 Wed, 30 Sep 2026 10:17:04 GMT The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role.