mitre

Reports to mitre (384)

Latest CVEs (this partner and the CNAs under it) · RSS

• CVE-2026-110889 2026-10-17 · Patchstack · CVSS 7.5
  Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This iss
• CVE-2026-110253 2026-10-17 · Wordfence · CVSS 5.4
  The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file pat
• CVE-2026-100316 2026-10-17 · Wordfence · CVSS 7.2
  The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions
• CVE-2026-109983 2026-10-17 · Wordfence · CVSS 6.4
  The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including,
• CVE-2026-111110 2026-10-17 · Wordfence · CVSS 7.2
  The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' para
• CVE-2026-110384 2026-10-17 · Patchstack · CVSS 7.1
  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-co
• CVE-2026-97314 2026-10-17 · WPScan
  The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing
• CVE-2026-81344 2026-10-17 · WPScan
  The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post c
• CVE-2026-81343 2026-10-17 · WPScan
  The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing s
• CVE-2026-110527 2026-10-17 · WPScan
  The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent pa
• CVE-2026-106470 2026-10-17 · WPScan
  The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a
• CVE-2026-103376 2026-10-17 · WPScan
  The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perfo
• CVE-2026-104122 2026-10-17 · WPScan
  The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level acc
• CVE-2026-92432 2026-10-17 · WPScan
  The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redi
• CVE-2026-92431 2026-10-17 · WPScan
  The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the
• CVE-2026-92433 2026-10-17 · WPScan
  The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in adminis
• CVE-2026-104246 2026-10-17 · WPScan
  The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, al
• CVE-2026-91074 2026-10-17 · WPScan
  The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authe
• CVE-2026-92798 2026-10-17 · Wordfence · CVSS 8.1
  The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to in
• CVE-2026-103899 2026-10-17 · Wordfence · CVSS 7.2
  The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions up to, and
• CVE-2026-109989 2026-10-17 · Wordfence · CVSS 6.4
  The Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and including, 1
• CVE-2026-107744 2026-10-17 · Wordfence · CVSS 6.5
  The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i
• CVE-2026-111726 2026-10-17 · Wordfence · CVSS 6.4
  The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and including, 7.
• CVE-2026-108123 2026-10-17 · Wordfence · CVSS 7.5
  The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to
• CVE-2026-92978 2026-10-17 · Wordfence · CVSS 4.3
  The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin