CVE-2026-121760

WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wedevs Wordpress-extensions

Products

Wedocs Wedocs

CVE-2026-111403

WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Reflected XSS.This issue affects WP Inventory Manager: from n/a through 2.5.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpinventory

Products

Wp Inventory Manager Wp Inventory Manager

CVE-2026-121780

WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gijo Varghese Wordpress-extensions

Products

Flying Images Flying Images

CVE-2026-123465

WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Mycred Wordpress-extensions

Products

Mycred Mycred

CVE-2026-121764

WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Foliovision Wordpress-extensions

Products

Fv Flowplayer Video Player Fv Flowplayer Video Player

CVE-2026-119514

WordPress RepairBuddy plugin <= 4.1234 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through 4.1234.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Webful Creations Wordpress-extensions

Products

Repairbuddy Repairbuddy

CVE-2026-106466

JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token Revocation

The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Jwt Auth

CVE-2026-115252

Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option

The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Confection

CVE-2026-106008

FraudLabs Pro SMS Verification 1.11.2 - 1.12.1 - Unauthenticated SMS Verification Bypass via wc_sms_action_verified

The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Fraudlabs Pro Sms Verification

CVE-2026-121570

WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpchill

Products

Rsvp And Event Management Rsvp And Event Management

CVE-2026-120855

WordPress TI WooCommerce Wishlist plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Templateinvaders Wordpress-extensions

Products

Ti Woocommerce Wishlist Ti Woocommerce Wishlist

CVE-2026-119524

WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Aguilatechnologies Wordpress-extensions

Products

Wp Customer Area Wp Customer Area

CVE-2026-120856

WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rymera Web Co Wordpress-extensions

Products

Invoice Gateway For Woocommerce – Invoice Payment Gateway Invoice Gateway For Woocommerce – Invoice Payment Gateway

CVE-2026-120854

WordPress iubenda plugin <= 3.13.6 - Denial of Service Attack vulnerability

Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Iubenda Wordpress-extensions

Products

Iubenda Iubenda

CVE-2026-122673

WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpmet

Products

Shopengine Shopengine

CVE-2026-112164

Hardcoded AES Key Enables Credential Disclosure

The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.

CVSS 4.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Laservideo

Products

Lasergest

CVE-2026-112165

Disabled TLS Certificate Validation Enables MITM Attacks

The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Laservideo

Products

Lasergest

CVE-2026-104989

Pre-authentication remote code execution in Chaos V-Ray Swarm

Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Chaos Software

Products

V-ray Swarm

CVE-2026-123368

compose-lint: .env read through a symlink outside the project can expose the CI job's environment

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From 0.28.0, the same gap also affects an include project_directory link outside the project. A pull request can reference a variable from the linked file, causing substitution to place runner file or process-environment data into finding messages written to logs, JSON, SARIF artifacts, and Code Scanning alerts. Reading /proc/self/environ can expose the remainder of the linter process environment because NUL-separated entries are treated as one value, although disclosure requires a workflow that processes untrusted changes with useful environment data and GitHub normally withholds secrets from fork pull requests. The pass or fail result is not changed. This issue is fixed in version 0.31.0.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Tmatens

Products

Compose-lint

CVE-2026-123369

compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action

compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tmatens

Products

Compose-lint