Threat database

CVE-2026-42704 is a high-severity vulnerability in the Kids Care theme by axiomthemes, affecting versions up to and including 3.2.4. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability could allow an attacker to include arbitrary files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-42702 is a high-severity reflected Cross-site Scripting (XSS) vulnerability in Themeum Tutor LMS affecting versions from initial release up to 4.1.0. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch or vendor advisory is provided in the data, so patch status is not confirmed.

CVE-2026-42699 is a high-severity vulnerability in FolioVision FV Player 8 versions up to 8.1.8. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can be triggered without authentication and affects confidentiality, integrity, and availability to a limited extent.

CVE-2026-42697 is a reflected cross-site scripting (XSS) vulnerability in the Inisev Social Share Icons & Social Share Buttons plugin (ultimate-social-media-plus). This vulnerability affects versions from initial releases up to 3.7.5. It allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. The vulnerability has a high severity score of 7.1 according to CVSS 3.1.

CVE-2026-42696 is a critical vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning that allows remote code inclusion due to improper control of code generation. This vulnerability affects versions from the initial release up to 1.5.19. It has a maximum CVSS score of 10.0, indicating it can be exploited remotely without privileges or user interaction, potentially leading to full system compromise.

CVE-2026-42693 is a high-severity cross-site scripting (XSS) vulnerability affecting TieLabs Jannah versions up to and including 7.6.5. The flaw allows unauthenticated attackers to inject malicious scripts during web page generation due to improper input neutralization. This vulnerability can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-42633 is a high severity SQL Injection vulnerability affecting Marcus Events Manager versions up to 7.4.6. It involves improper neutralization of special elements in SQL commands related to subscriber data, allowing an attacker with low privileges to execute unauthorized SQL queries. This vulnerability can lead to complete compromise of confidentiality and partial impact on availability, but no integrity loss is indicated.

CVE-2026-42632 is a high-severity cross-site scripting (XSS) vulnerability affecting Qode Real Estate versions up to and including 1.1.7.3. The flaw allows unauthenticated attackers to inject malicious scripts during web page generation due to improper input neutralization. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected application.

CVE-2026-42631 is a high-severity vulnerability in Qode Music versions up to and including 2.1.8.2. It is an unauthenticated Cross-Site Scripting (XSS) flaw that arises from improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that may lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is currently provided.

CVE-2026-42630 is a high-severity vulnerability in Web Plura Backup & Restore Manager versions up to 0.2.25. It involves unauthenticated exposure of sensitive data due to insertion of sensitive information into sent data. This flaw allows an attacker without authentication to access sensitive information, impacting confidentiality but not integrity or availability.

CVE-2026-42419 is a vulnerability in Swish Migrate and Backup versions up to 1.4.0 that allows unauthenticated exposure of sensitive data due to insertion of sensitive information into sent data. The vulnerability has a medium severity with a CVSS score of 5.9. No patch or remediation information is provided.

CVE-2026-40808 is a medium severity vulnerability in Automattic Jetpack VideoPress versions up to 3.6. It involves missing authorization controls, classified as CWE-862, which can lead to broken access control allowing unauthorized actions that impact integrity but not confidentiality or availability.

CVE-2026-40803 is a high-severity vulnerability in Jotform – AI Chatbot versions up to 3.8.2. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability. No specific affected versions or patch information is provided.

CVE-2026-40802 is a high-severity vulnerability in Pubjet (versions up to and including 5.4.8) involving missing authorization controls. It allows an attacker with limited privileges to change subscriber settings without proper authorization. The vulnerability has a CVSS score of 7.6, indicating significant impact on integrity and some impact on confidentiality and availability.

CVE-2026-40800 is a critical SQL Injection vulnerability in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes versions up to and including 1.5.3. It allows an unauthenticated attacker to inject malicious SQL commands, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation information is provided yet.

CVE-2026-40777 is a high-severity vulnerability in Rashid WPSection versions up to 1.5.1 that involves missing authorization controls. This broken access control flaw allows users with limited privileges to perform unauthorized actions, impacting the integrity and availability of the affected system. No specific affected versions beyond "<= 1.5.1" are detailed, and no patch or remediation information is provided.

CVE-2026-39802 is a high-severity vulnerability in Everest Backup versions up to and including 2.3.13. It allows unauthenticated remote code execution due to improper control of code generation (CWE-94). This flaw could enable an attacker to execute arbitrary code on the affected system without any authentication.

CVE-2026-39801 is a critical vulnerability in Sergey AIWU versions up to 1.5.9 that allows subscriber privilege escalation due to incorrect privilege assignment. This flaw enables an attacker to gain elevated privileges without authorization, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-39800 is a high severity vulnerability involving unauthenticated Cross-Site Scripting (XSS) in the Additional Order Filters for WooCommerce plugin by Anton Bond. It affects versions up to and including 1.24. The vulnerability allows an attacker to inject malicious scripts during web page generation without authentication. This can lead to partial compromise of confidentiality, integrity, and availability. No official patch or remediation details are provided in the available data.

CVE-2026-39799 is a high-severity vulnerability in the WP File Download plugin by Joomunited. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks due to improper neutralization of input during web page generation. This affects versions up to and including 6.3.6. The vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is provided in the available data.