CVE-2026-107100Published
Royal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_content
cve-program ·
Vendor product: Royal Addons for Elementor
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694174 source statements · aliases may refer to the same vulnerabilityCVE-2026-110292Published
PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent
cve-program ·
Vendor product: PayPlug for WooCommerce (Official)
CVE-2026-110506Published
Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
cve-program ·
Vendor product: Page Builder by SiteOrigin
CVE-2026-110507Published
Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments
cve-program ·
Vendor product: Page Builder by SiteOrigin
CVE-2026-114265Published
ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection
cve-program ·
Vendor product: Advanced Library Management System
CVE-2026-110509Published
Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler
cve-program ·
Vendor product: Essential Addons for Elementor
CVE-2026-110524Published
Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute
cve-program ·
Vendor product: Copy Anything to Clipboard for WordPress
CVE-2026-110691Published
WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update
cve-program ·
Vendor product: WPOrLogin
CVE-2026-111021Published
Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter
cve-program ·
Vendor product: افزونه پیامک ووکامرس | Persian WooCommerce SMS
CVE-2026-111027Published
Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter
cve-program ·
Vendor product: Welcart e-Commerce
CVE-2026-111031Published
Welcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' Parameter
cve-program ·
Vendor product: Welcart e-Commerce
CVE-2026-111032Published
Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax
cve-program ·
Vendor product: Welcart e-Commerce
CVE-2026-111577Published
GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings
cve-program ·
Vendor product: GoSMTP
CVE-2026-111960Published
Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability
cve-program ·
Vendor product: Royal MCP
CVE-2026-111961Published
Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page
cve-program ·
Vendor product: Royal MCP
CVE-2026-111967Published
MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
cve-program ·
Vendor product: MP3 Audio Player
CVE-2026-113485Published
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
cve-program ·
Vendor product: Media Library Assistant
CVE-2026-113486Published
Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF
cve-program ·
Vendor product: Media Library Assistant
CVE-2026-113487Published
GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute
cve-program ·
Vendor product: GeoDirectory
CVE-2026-113488Published
GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute
cve-program ·
Vendor product: GeoDirectory
CVE-2026-113494Published
GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
cve-program ·
Vendor product: GeoDirectory
CVE-2026-113813Published
PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
cve-program ·
Vendor product: PayPlug for WooCommerce (Official)
CVE-2026-115224Published
Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
cve-program ·
Vendor product: Customer Engagement System
CVE-2026-115225Published
Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup
cve-program ·
Vendor product: Customer Engagement System
CVE-2026-115255Published
WP Roster < 2.35 - Unauthenticated Roster Member Deletion
cve-program ·
Vendor product: WP Roster
CVE-2026-115281Published
Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
cve-program ·
Vendor product: Recipe Card Blocks Lite
CVE-2026-91343Published
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated atta…
cve-program ·
Vendor product: Oracle Outside In Technology
CVE-2026-91335Published
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21…
cve-program ·
Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition
CVE-2026-91334Published
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1…
cve-program ·
Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition
CVE-2026-102834Published
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
cve-program ·
Vendor product: javacv
CVE-2026-91333Published
Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multipl…
cve-program ·
Vendor product: Oracle Java SE
CVE-2026-91331Published
Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows high pri…
cve-program ·
Vendor product: PeopleSoft Enterprise CC Common Application Objects
CVE-2026-96626Published
Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host
cve-program ·
Vendor product: arcane
CVE-2026-91336Published
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Ora…
cve-program ·
Vendor product: Oracle Solaris
CVE-2026-103313Published
BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handler
cve-program ·
https://wordpress.org/plugins: BitPay Gateway for WooCommerce
CVE-2026-103330Published
Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypass
cve-program ·
https://wordpress.org/plugins: Sadad QA Payment
CVE-2026-106648Published
Royal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID Shortcodes
cve-program ·
https://wordpress.org/plugins: Royal Elementor Addons
CVE-2026-110508Published
Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification
cve-program ·
https://wordpress.org/plugins: Essential Addons for Elementor
CVE-2026-115223Published
Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block
cve-program ·
https://wordpress.org/plugins: Smart Popup by Supsystic
CVE-2026-39795Published
WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability
cve-program ·
https://wordpress.org/plugins: sendpress
CVE-2026-103325Published
TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass
cve-program ·
https://wordpress.org/plugins: TiendaCrypto para WooCommerce
CVE-2026-103359Published
PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgery
cve-program ·
https://wordpress.org/plugins: PayDunya WooCommerce Payment Gateway
CVE-2026-91328Published
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with …
cve-program ·
Vendor product: JD Edwards EnterpriseOne Tools
CVE-2026-91329Published
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attac…
cve-program ·
Vendor product: JD Edwards EnterpriseOne Tools
CVE-2026-91330Published
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker…
cve-program ·
Vendor product: JD Edwards EnterpriseOne Tools
CVE-2026-114491Published
pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
cve-program ·
https://www.npmjs.com: pdfmake
CVE-2026-91327Published
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attac…
cve-program ·
Vendor product: JD Edwards EnterpriseOne Tools
CVE-2026-112005Published
WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor
cve-program ·
Vendor product: whodb
CVE-2026-91326Published
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacke…
cve-program ·
Vendor product: JD Edwards EnterpriseOne Tools
CVE-2026-114133Published
Nuxt server islands render `useHeadSafe` input without sanitisation
cve-program ·
Vendor product: nuxt
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.