CVE-2025-62315

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-21832

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-28003

WordPress Maspik – Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Yonifre

Products

Wordpress Maspik – Spam Blacklist

CVE-2026-28155

WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Lasso Analytics, Inc. Wordpress

Products

Do Lasso Wordpress

CVE-2026-28156

WordPress Do Lasso plugin <= 358 - SQL Injection vulnerability

Subscriber SQL Injection in Do Lasso <= 358 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Lasso Analytics, Inc. Wordpress

Products

Do Lasso Wordpress

CVE-2026-28157

WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability

Subscriber Path Traversal in Do Lasso <= 358 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Lasso Analytics, Inc. Wordpress

Products

Do Lasso Wordpress

CVE-2026-28158

WordPress Do Lasso plugin <= 358 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Lasso Analytics, Inc. Wordpress

Products

Do Lasso Wordpress

CVE-2026-28159

WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability

Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Aonetheme Wordpress

Products

Service Finder Booking Wordpress

CVE-2026-28161

WordPress Service Finder Booking plugin <= 6.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Aonetheme Wordpress

Products

Service Finder Booking Wordpress

CVE-2026-28168

WordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability

Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Imran Tauqeer Wordpress

Products

Cubewp Wordpress

CVE-2026-28185

WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Rtcamp Wordpress

Products

Log In With Google Wordpress

CVE-2026-28186

WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Travelfic Toolkit Wordpress

CVE-2026-61978

WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Webhosting4ugr Wordpress

Products

Secure Card Gateway For Epay Paycenter (piraeus Bank) Wordpress

CVE-2026-65580

WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Bracketweb Wordpress

Products

Agrion Wordpress

CVE-2026-66446

WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability

Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

If-so Dynamic Content Wordpress

Products

If-so Dynamic Content Personalization Wordpress

CVE-2026-66455

WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Rockiger Wordpress

Products

Reactpress Wordpress

CVE-2026-66462

WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Bookingwp Wordpress

Products

Woocommerce Appointments Wordpress

CVE-2026-66463

WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hassan Fakih Wordpress

Products

Icarry Wordpress

CVE-2026-66464

WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Toast Plugins Wordpress

Products

Internal Link Optimiser Wordpress

CVE-2026-66465

WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Agnihd Wordpress

Products

Cartify Wordpress