Veille CVE

Semaine du 29 juin au 5 juillet 2026

100 CVE

Critique 13 Élevée 54 Moyenne 32 Faible 0 Non évaluée 1 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-50238 – Non évaluée Rejetée

    Rejected reason: Red Hat Product Security has concluded that this CVE is not required. The reported issue has been classified as a regular bug and will be addressed through the standard bug-fixing process.

  2. CVE-2026-57766 8.8 Élevée

    XplodedThemes WPIDE – File Manager & Code Editor

    Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.

  3. CVE-2026-57765 8.5 Élevée

    Levelfourdevelopment WP EasyCart

    Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.

  4. CVE-2026-57758 7.1 Élevée

    BeRocket Permalink Manager for WooCommerce

    Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions.

  5. CVE-2026-57753 5.3 Moyenne

    Nathanbarry Kit (formerly ConvertKit) for WooCommerce

    Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions.

  6. CVE-2026-57752 8.5 Élevée

    iNET Webkit

    Contributor SQL Injection in iNET Webkit 1.2.4 versions.

  7. CVE-2026-57747 6.5 Moyenne

    ThemeREX Booked

    Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.

  8. CVE-2026-57746 7.1 Élevée

    ThemeREX Booked

    Subscriber Broken Access Control in Booked <= 3.0.0 versions.

  9. CVE-2026-57688 8.2 Élevée

    Gurmehub POS Entegratör

    Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.

  10. CVE-2026-57687 8.5 Élevée

    Hiroaki Miyashita Custom Field Template

    Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.

  11. CVE-2026-57682 7.1 Élevée

    QuantumCloud Simple Link Directory

    Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 versions.

  12. CVE-2026-57681 6.4 Moyenne

    Paolo GeoDirectory

    Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions.

  13. CVE-2026-57674 7.1 Élevée

    Arraytics Timetics

    Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.

  14. CVE-2026-57673 7.1 Élevée

    Optimole

    Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

  15. CVE-2026-57625 9.6 Critique

    ASE Admin and Site Enhancements (ASE) Pro

    Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.

  16. CVE-2026-57624 10.0 Critique

    Creative Themes Blocksy Companion Pro

    Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.

  17. CVE-2026-57362 7.1 Élevée

    QuantumCloud ChatBot

    Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions.

  18. CVE-2026-57361 7.1 Élevée

    Ays Pro Survey Maker

    Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.2.5 versions.

  19. CVE-2026-57356 7.1 Élevée

    Moreconvert Team MC Woocommerce Wishlist

    Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions.

  20. CVE-2026-57350 7.1 Élevée

    Andy Fragen WP Debugging

    Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions.

  21. CVE-2026-50281 7.1 Élevée

    craftcms cms

    Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes the attacker's attributes into the victim's existing entry row. ElementsController::beforeAction() pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level, actionBulkDuplicate(), reads a separate newAttributes array and passes it straight through to the service layer. Elements::duplicateElement() clones the source element, sets id to null, and then hands the attacker's array to Craft::configure(), which overwrites the reset id with any numeric value inside $newAttributes. PHP Yii's saveElement() then performs an UPDATE against the row with that primary key instead of an INSERT. The attackers's title, slug, authorId, postDate, and UID land on the victim's entry. safeAttributes() on Entry includes id because the base element model exposes it, so the Collection::only() filter does not strip it. This issue has been fixed in version 5.9.21.

  22. CVE-2026-57343 7.1 Élevée

    Contempoinc Real Estate 7

    Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions.

  23. CVE-2026-27412 8.1 Élevée

    StylemixThemes Pearl - Corporate Business

    Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

  24. CVE-2022-50973 9.8 Critique

    Yonyou Network Technology Co., Ltd. KSOA

    Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attackers to upload arbitrary files by submitting a POST request with attacker-controlled filepath and filename parameters without any authentication, file type, extension, or content validation. Attackers can upload a JSP webshell by specifying a malicious filename and root filepath, with the uploaded file stored under the pictures directory and directly executed by the web server, resulting in unauthenticated remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-11-07 (UTC).

  25. CVE-2026-50282 4.9 Moyenne

    craftcms cms

    Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination. This issue has been resolved in versions 5.9.21 and 4.17.14.

  26. CVE-2026-58653 4.3 Moyenne

    PraisonAI

    PraisonAI before 0.1.7 fails to validate that project_id in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace constraints.

  27. CVE-2026-8699 7.0 Élevée

    TP-Link Systems Inc. Archer C5 v6.8

    A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input in a certain field.  An attacker with administrative privileges can inject crafted HTML or JS payloads into the affected field. The payload is stored and later executed when the affected page is rendered in an administrator's browser.Successful exploitation allows execution of arbitrary JavaScript in an admin's browser, potentially leading to session hijacking and unauthorized access to router configuration, possibly resulting in exposure of sensitive data and modification of device settings. The vulnerability affects ISP-managed firmware variants of the product. Remediation is coordinated through service providers.

  28. CVE-2026-12168 7.8 Élevée

    Little Orbit GameFirst Anti-Cheat

    An improper validation vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to escalate privileges to SYSTEM and execute arbitrary code in kernel mode via crafted messages sent through a Minifilter communication port.

  29. CVE-2026-12167 7.8 Élevée

    Little Orbit GameFirst Anti-Cheat

    The Minifilter communication port for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to access privileged driver functionality via a communication interface that lacks appropriate access restrictions.

  30. CVE-2026-12166 5.5 Moyenne

    Little Orbit GameFirst Anti-Cheat

    A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of service via crafted requests that trigger a system crash.

  31. CVE-2026-54405 7.5 Élevée

    Ubiquiti Inc UniFi Network Application · Ui unifi network application

    A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of Service (DoS) attack on the application.

  32. CVE-2026-56004 10.0 Critique

    openSUSE buildservice

    A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

  33. CVE-2026-54431 5.1 Moyenne

    OpenIDC liboauth2

    In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header. This issue was fixed in version 2.3.0

  34. CVE-2026-54430 5.1 Moyenne

    OpenIDC liboauth2

    liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to alb_base_url without URL encoding or path sanitization, and the HTTP GET is issued before signature verification. This allows an attacker to force the server to send a GET request to an attacker-chosen internal path. This issue was fixed in version 2.3.0

  35. CVE-2026-14449 6.4 Moyenne

    u5CMS

    u5CMS through v12.8.8 is vulnerable to reflected XSS via the ‘thanks’ parameter in multiple form components

  36. CVE-2026-11946 7.5 Élevée

    open62541 project / o6 Automation GmbH open62541

    An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master.

  37. CVE-2026-57761 7.1 Élevée

    BlueAstralThemes SEOWP

    Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.

  38. CVE-2026-57754 6.5 Moyenne

    Livemesh Addons for WPBakery Page Builder

    Contributor Cross Site Scripting (XSS) in Livemesh Addons for WPBakery Page Builder <= 3.9.4 versions.

  39. CVE-2026-57748 7.5 Élevée

    Shopify Help Center Shopify

    Contributor Local File Inclusion in Shopify <= 1.0.0 versions.

  40. CVE-2026-57689 4.3 Moyenne

    Fuelthemes Werkstatt

    Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions.

  41. CVE-2026-57683 9.3 Critique

    Epsiloncool WP Fast Total Search

    Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.

  42. CVE-2026-57675 7.1 Élevée

    Jacob N. Breetvelt WP Photo Album Plus

    Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions.

  43. CVE-2026-57669 6.5 Moyenne

    Vsourz Digital Advanced Contact form 7 DB

    Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

  44. CVE-2026-57366 7.1 Élevée

    Greg Winiarski WPAdverts

    Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions.

  45. CVE-2026-57357 7.1 Élevée

    Search Atlas Group Search Atlas SEO

    Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

  46. CVE-2026-57351 7.1 Élevée

    Haktan Suren HandL UTM Grabber

    Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

  47. CVE-2026-57344 7.1 Élevée

    RadiusTheme Classified Listing

    Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

  48. CVE-2026-56037 8.8 Élevée

    Themify Popup

    Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.

  49. CVE-2026-27436 9.1 Critique

    Rustaurius Five Star Business Profile and Schema

    Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.

  50. CVE-2026-27414 8.8 Élevée

    Fuelthemes Werkstatt

    Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.

  51. CVE-2026-5524 9.8 Critique

    Divi Engine Divi Form Builder

    The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading to Remote Code Execution in all versions up to and including 5.1.8. This is due to insufficient file extension validation in the do_image_upload() function where user-supplied input from the acceptFileTypes POST parameter is directly interpolated into a regular expression used to validate uploaded files. Attackers can specify PHP-executable extensions such as .phtml, .phar, .php5, or .php7 to bypass the plugin's .htaccess protection which only blocks .php files specifically. Additionally, on Nginx-based servers, the .htaccess protection is completely ineffective as Nginx does not process .htaccess files. This makes it possible for unauthenticated attackers (who can obtain a nonce from any public page containing a form) to upload executable PHP files to the publicly accessible /wp-content/uploads/de_fb_uploads/ directory and achieve Remote Code Execution by accessing the uploaded file via HTTP. The vulnerability was partially patched in version 5.1.3.

  52. CVE-2026-57764 6.5 Moyenne

    Surbma | Yoast SEO Breadcrumb Shortcode

    Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions.

  53. CVE-2026-57757 7.1 Élevée

    ploudapp pCloud WP Backup

    Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.

  54. CVE-2026-57751 8.1 Élevée

    Heateor Support Heateor Social Login

    Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.

  55. CVE-2026-57731 6.5 Moyenne

    UX-themes Flatsome

    Contributor Broken Access Control in Flatsome <= 3.20.5 versions.

  56. CVE-2026-57686 7.1 Élevée

    WPXPO WowAddons

    Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

  57. CVE-2026-57680 6.5 Moyenne

    Themeum Kirki

    Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.

  58. CVE-2026-57672 7.1 Élevée

    Melograno Venture Studio wpDataTables

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

  59. CVE-2026-57623 9.0 Critique

    BoldGrid W3 Total Cache

    Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.

  60. CVE-2026-57360 7.1 Élevée

    impleCode eCommerce Product Catalog

    Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.5.4 versions.

  61. CVE-2026-57355 6.5 Moyenne

    RadiusTheme Classified Listing

    Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

  62. CVE-2026-57354 6.5 Moyenne

    Crocoblock. Jetimpex Inc. JetReviews

    Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

  63. CVE-2026-57349 7.1 Élevée

    etruel WPeMatico RSS Feed Fetcher

    Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions.

  64. CVE-2026-57348 7.2 Élevée

    Cozmoslabs Paid Member Subscriptions

    Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.

  65. CVE-2026-57342 6.5 Moyenne

    ShortPixel Adaptive Images

    Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.

  66. CVE-2026-4767 9.8 Critique

    TR7 Cyber ​​Defense Inc. WAF-ASP

    Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

  67. CVE-2026-27430 7.1 Élevée

    tranmautritam TheFox

    Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.

  68. CVE-2026-27426 7.1 Élevée

    Themesuite Automotive Car Dealership Business

    Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.

  69. CVE-2026-27404 7.1 Élevée

    Designthemes LMS

    Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.

  70. CVE-2026-4772 5.4 Moyenne

    TR7 Cyber ​​Defense Inc. WAF-ASP

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Stored XSS. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

  71. CVE-2026-4770 4.6 Moyenne

    TR7 Cyber ​​Defense Inc. WAF-ASP

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. Web Application Firewall allows DOM-Based XSS. This issue affects Web Application Firewall: from v1.0.42.239 before v1.4.0.117.

  72. CVE-2026-57763 6.5 Moyenne

    Gordon Böhme Structured Content

    Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.

  73. CVE-2026-57762 5.9 Moyenne

    Andrew Fiebert Simple URLs

    Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.

  74. CVE-2026-57760 5.3 Moyenne

    Sendcloud Shipping

    Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29.

  75. CVE-2026-57756 8.5 Élevée

    友人a丶 nicen-localize-image

    Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.

  76. CVE-2026-57755 6.5 Moyenne

    Misbah WP Mosaic Gallery &#8211; Advanced Gallery

    Contributor Cross Site Scripting (XSS) in Mosaic Gallery &#8211; Advanced Gallery <= 1.2.0 versions.

  77. CVE-2026-57750 5.3 Moyenne

    Keksdieb ez Form Calculator Premium

    Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.

  78. CVE-2026-57749 7.5 Élevée

    ThemeBoy SportsPress Pro

    Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.

  79. CVE-2026-57730 4.3 Moyenne

    UX-themes Flatsome

    Subscriber Broken Access Control in Flatsome <= 3.20.5 versions.

  80. CVE-2026-57690 4.3 Moyenne

    Fuelthemes Werkstatt

    Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.

  81. CVE-2026-57685 4.3 Moyenne

    drfuri Martfury - WooCommerce Marketplace WordPress Theme

    Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions.

  82. CVE-2026-57684 6.5 Moyenne

    tranmautritam TheFox

    Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.

  83. CVE-2026-57679 9.3 Critique

    Ahmadgb GeekyBot

    Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.

  84. CVE-2026-57678 7.1 Élevée

    ThemePunch Slider Revolution

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemePunch Slider Revolution allows Reflected XSS. This issue affects Slider Revolution: from 7.0.0 through 7.0.16.

  85. CVE-2026-57677 9.8 Critique

    Novalnet Payment Gateway for WooCommerce

    Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions.

  86. CVE-2026-57671 7.1 Élevée

    perfmatters

    Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.4 versions.

  87. CVE-2026-57670 7.1 Élevée

    Codepeople Google Maps CP

    Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.

  88. CVE-2026-57621 9.8 Critique

    Arraytics Booktics

    Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.

  89. CVE-2026-57426 7.1 Élevée

    Chill Media Labs S.R.L. Modula - PRO

    Unauthenticated Cross Site Scripting (XSS) in Modula - PRO <= 2.10.8 versions.

  90. CVE-2026-57359 7.1 Élevée

    ReviewX

    Unauthenticated Cross Site Scripting (XSS) in ReviewX <= 2.3.10 versions.

  91. CVE-2026-57358 7.1 Élevée

    SysBasics Customize My Account for WooCommerce

    Unauthenticated Cross Site Scripting (XSS) in Customize My Account for WooCommerce <= 4.3.9 versions.

  92. CVE-2026-57353 6.5 Moyenne

    LinkWhisper Link Whisper Premium

    Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

  93. CVE-2026-57352 4.8 Moyenne

    VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce

    Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions.

  94. CVE-2026-57347 6.5 Moyenne

    jetmonsters Hotel Booking Lite

    Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.

  95. CVE-2026-57345 7.1 Élevée

    Webraketen Internal Links Manager

    Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions.

  96. CVE-2026-42382 8.1 Élevée

    Elated-Themes Audrey

    Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.

  97. CVE-2026-39448 7.5 Élevée

    CoderPress NOWPayments for WooCommerce

    Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

  98. CVE-2026-27425 7.1 Élevée

    Themesuite Automotive Listings

    Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.

  99. CVE-2026-27419 9.9 Critique

    Zozothemes Zegen

    Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.

  100. CVE-2026-27402 7.1 Élevée

    Designthemes Kids Life | Children School WordPress

    Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.