Fresh 2026 Zero-Days & Newly Disclosed CVEs

Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions....

Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions....

Unauthenticated Broken Access Control in DK <= 3.2.1 versions....

Unauthenticated Broken Access Control in Grand News <= 3.4 versions....

Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions....

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0....

Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions....

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.T...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected XSS.This issue affects Jannah: from n/a before 7.6.8....

Subscriber SQL Injection in Events Manager <= 7.4.6 versions....

Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions....

Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions....

Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions....

Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions....

Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions....

Missing Authorization vulnerability in pubjet Pubjet | پاب‌جت pubjet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pubjet | پاب‌جت: from n/a through 5.4.8....

Subscriber Broken Access Control in Wordable <= 8.2.10 versions....

Subscriber Broken Access Control in WPSection <= 1.5.1 versions....

Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions....

Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions....

Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions....

Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta....

Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3....

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue...