| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-104769 | Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link> | asadkn | Debloat – Remove Unused CSS, Optimize JS | Medium | 5.9 | 2026-10-16 03:38:42 | Deep Dive |
| CVE-2026-104745 | Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter | wpcodefactory | Customer Email Verification for WooCommerce | High | 8.1 | 2026-10-16 03:38:41 | Deep Dive |
| CVE-2026-93953 | Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation | softaculous | Backuply – Backup, Restore, Migrate and Clone | High | 8.0 | 2026-10-16 03:38:41 | Deep Dive |
| CVE-2026-97339 | Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter | complianz | Complianz GDPR/CCPA Cookie Consent Banner | High | 7.2 | 2026-10-16 03:38:41 | Deep Dive |
| CVE-2026-103518 | FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys | wpmanageninja | FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler | Medium | 4.9 | 2026-10-16 03:38:40 | Deep Dive |
| CVE-2026-77829 | Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content | goratech | Cooked – Recipe Management | Medium | 6.4 | 2026-10-16 03:38:40 | Deep Dive |
| CVE-2026-109990 | Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content | gijo | Flying Scripts: Delay JavaScript to Improve Site Speed & Performance | High | 7.2 | 2026-10-16 03:38:40 | Deep Dive |
| CVE-2026-93535 | WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute | wppool | Dark Mode – Improve Accessibility with AI Powered Dark Theme | Medium | 6.4 | 2026-10-16 03:38:39 | Deep Dive |
| CVE-2026-111446 | Wheels 4.0.0-4.1.2 未授权访问漏洞 | Wheels | Wheels | High | 8.6 | 2026-10-16 03:37:32 | Deep Dive |
| CVE-2026-111445 | Wheels 4.0.0-4.1.2 存在越权漏洞 | Wheels | Wheels | High | 8.1 | 2026-10-16 03:35:01 | Deep Dive |
| CVE-2026-111444 | Wheels 4.1.2 存在 SQL 注入漏洞 | Wheels | Wheels | Critical | 9.8 | 2026-10-16 03:31:30 | Deep Dive |
| CVE-2026-111443 | Wheels 4.0.6-4.1.2 上下文切换漏洞 | Wheels | Wheels | Medium | 6.5 | 2026-10-16 03:28:29 | Deep Dive |
| CVE-2026-111442 | Backdrop CMS 1.34/1.35 反射型XSS漏洞 | BackdropCMS | Backdrop | Medium | 5.3 | 2026-10-16 03:09:44 | Deep Dive |
| CVE-2026-109813 | Shared Hard-coded Root CA Private Key | Moxa | AIG-302 Series | High | 8.6 | 2026-10-16 02:57:52 | Deep Dive |
| CVE-2026-109812 | Missing Authorization on Secret Endpoints | Moxa | AIG-302 Series | Medium | 6.9 | 2026-10-16 02:54:47 | Deep Dive |
| CVE-2026-100159 | Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers | ays-pro | Popup Box – Create Countdown, Coupon, Video, Contact Form Popups | Medium | 4.8 | 2026-10-16 02:26:09 | Deep Dive |
| CVE-2026-105228 | ISPSoft Out-of-Bounds Read Vulnerability | Deltaww | ISPSoft | High | 7.0 | 2026-10-16 01:27:56 | Deep Dive |
| CVE-2026-105227 | ISPSoft Out-of-Bounds Read Vulnerability | Deltaww | ISPSoft | High | 7.0 | 2026-10-16 01:27:28 | Deep Dive |
| CVE-2026-111389 | Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation | frappe | hrms | High | 7.7 | 2026-10-16 01:17:58 | Deep Dive |
| CVE-2026-111388 | Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication | frappe | frappe | Medium | 5.4 | 2026-10-16 01:17:57 | Deep Dive |