Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

677578 source statements · aliases may refer to the same vulnerability

CVE-2026-112851Published

WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: hotlock

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112846Published

WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: save-life

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112847Published

WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: zensoul

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112854Published

WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

cve-program ·

https://themeforest.net: holistic-center

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112850Published

WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability

cve-program ·

https://themeforest.net: your-dress

CVSS 3.1 8.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112848Published

WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: hostmev2

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-111402Published

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: newsletters-lite

CVSS 3.1 9.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-94075Published

WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: newsletters-lite

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112866Published

WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability

cve-program ·

https://wordpress.org/plugins: woo-product-filter

CVSS 3.1 9.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114190Published

WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability

cve-program ·

https://wordpress.org/plugins: litespeed-cache

CVSS 3.1 5.9Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-110892Published

WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: suredash

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114196Published

WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: paytium

CVSS 3.1 9.8Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114705Published

WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: insta-gallery

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114192Published

WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: mage-eventpress

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114704Published

WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability

cve-program ·

https://wordpress.org/plugins: relevanssi

CVSS 3.1 7.2Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114191Published

WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability

cve-program ·

https://wordpress.org/plugins: upi-qr-code-payment-for-woocommerce

CVSS 3.1 7.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112863Published

WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://themeforest.net: kallyas

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114179Published

WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: bp-better-messages

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112844Published

WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: wp-event-solution

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112869Published

WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: opening-hours

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114178Published

WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: w3-total-cache

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114697Published

WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: qa-heatmap-analytics

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114693Published

WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: all-in-one-video-gallery

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114694Published

WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: events-manager

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114695Published

WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: vod-infomaniak

CVSS 3.1 7.1Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114194Published

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: ad-inserter

CVSS 3.1 6.5Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-107887Published

Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme

cve-program ·

Vendor product: Advanced Twenty Seventeen

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-87835Published

Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment

cve-program ·

Vendor product: Front End Users

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-107907Published

MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist

cve-program ·

Vendor product: MAS Videos

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-97352Published

News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

cve-program ·

Vendor product: News Kit Addons For Elementor

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-97353Published

News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form

cve-program ·

Vendor product: News Kit Addons For Elementor

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-105199Published

Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID

cve-program ·

Vendor product: Pixel Tag Manager for WooCommerce

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-110956Published

asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation

cve-program ·

Vendor product: asVereinbase

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-112207Published

Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link

cve-program ·

Vendor product: Download Monitor

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113489Published

GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113490Published

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113491Published

GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113492Published

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113493Published

GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113673Published

GeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-113674Published

GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification

cve-program ·

Vendor product: GeoDirectory

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-114429Published

WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content

cve-program ·

Vendor product: WPVR

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-109935Published

Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API

cve-program ·

Vendor product: Otter Blocks

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115933Published

Forged signed tokens let any registered user take over other users and organizations

cve-program ·

Vendor product: postiz-app

CVSS 3.1 9.9Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115931Published

Arbitrary file read and backend crash through unrestricted provider method calls

cve-program ·

Vendor product: postiz-app

CVSS 3.1 9.9Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-115932Published

Path traversal in post media lets any registered user read server files

cve-program ·

Vendor product: postiz-app

CVSS 3.1 9.6Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-99999Published

ipv4: validate checksum_start before completing checksum

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 9.3Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-89673Published

nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo

cve-program ·

Vendor product: Linux · Vendor product: Linux

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-89623Published

HID: mcp2221: stop device IO before hid_hw_stop

cve-program ·

Vendor product: Linux · Vendor product: Linux

Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-99083Published

ksmbd: fix heap out-of-bounds write in krb5_authenticate()

cve-program ·

Vendor product: Linux · Vendor product: Linux

CVSS 3.1 8.8Source modified 24 Oct 2026Recorded 24 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.