Common Vulnerabilities and Exposures (CVE)
CVE-2026-54198
Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.
CVE-2026-54197
Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.
CVE-2026-54191
Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.
CVE-2026-54190
Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.
CVE-2026-52715
Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.
CVE-2026-52714
Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.
CVE-2026-52712
Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.
CVE-2026-52711
Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.
CVE-2026-39581
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.
CVE-2026-39574
Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.
CVE-2026-39490
Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.
CVE-2026-39437
Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.
CVE-2025-68045
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.
CVE-2026-10825
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and handling of JSON-based requests. A low-privileged authenticated attacker can send a specially crafted request that causes service disruption an...
CVE-2026-5416
Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.