CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- hclsoftware devops deploy, hcltechsw hcl devops deploy +1 moreHCL DevOps Deploy is susceptible to insufficiently protected credentials4.9 Medium
- efacec qc 60/90/120DENIAL OF SERVICE VIA ICMP PACKETS8.2 High
- efacec qc60/90/120DENIAL OF SERVICE VIA ARP PACKETS9.2 Critical
- minnur external mediaWordPress External Media plugin <= 1.0.36 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- data illusion zumbrunn ngsurveyNGSurvey Enterprise 3.6.4 incorrect authorization exposes other users’ API keys and personal data5.1 Medium
- kieback&peter neutrino-gltCommand injection in Kieback&Peter Neutrino-GLT6.9 Medium
- digital zoom studio dzs video galleryWordPress DZS Video Gallery plugin <= 12.37 - PHP Object Injection Vulnerability9.8 Critical
- themesgrove widgetkit proWordPress WidgetKit Pro plugin <= 1.13.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- posimyth innovation the plus addons for elementor proWordPress The Plus Addons for Elementor Pro plugin < 6.3.7 - Broken Access Control vulnerability6.5 Medium
- sigmaplugin advanced database cleaner proWordPress Advanced Database Cleaner PRO Plugin <= 3.2.10 - Limited .txt Path Traversal vulnerability6.4 Medium
- mojoomla wpchurchWordPress WPCHURCH plugin <= 2.7.0 - SQL Injection Vulnerability9.3 Critical
- digital zoom studio dzs video galleryWordPress DZS Video Gallery plugin <= 12.25 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- dasinfomedia wpchurchWordPress WPCHURCH plugin <= 2.7.0 - Privilege Escalation Vulnerability8.8 High
lrucrates.io`IterMut` violates Stacked Borrows by invalidating internal pointer2.7 Low- janstudio geckoWordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability8.1 High
- themerex hopeWordPress Hope theme <= 3.0.0 - Local File Inclusion vulnerability8.1 High
- frenify arloWordPress Arlo theme <= 6.0.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.1.1 - Broken Access Control vulnerability4.3 Medium
- themehunk oneline liteWordPress Oneline Lite theme <= 6.6 - Broken Access Control vulnerability4.3 Medium
- apache uniffleApache Uniffle: Insecure SSL Configuration in Uniffle HTTP Client9.1 Critical
- tugbucket multi-column tag mapMulti-column Tag Map <= 17.0.39 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'mctm_css_conditional' Parameter4.4 Medium
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder5.3 Medium
- spwebguy responsive pricing tableResponsive Pricing Table <= 5.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'table_currency'6.4 Medium
- openchamp simcastSimcast <= 1.0.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- enartia piraeus bank woocommerce payment gatewayPiraeus Bank WooCommerce Payment Gateway <= 3.1.4 - Missing Authorization to Unauthenticated Arbitrary Order Status Change5.3 Medium
- anybodesign ad sliding faqAD Sliding FAQ <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- chrisblackwell 1180px shortcodes1180px Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute6.4 Medium
- corsonr easy github gist shortcodesEasy GitHub Gist Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute6.4 Medium
- samikeijonen edd download infoEDD Download Info <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- themehigh email customizer for woocommerce | drag and drop email templates builderEmail Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content4.4 Medium
- clevelandwebdeveloper smart app bannersSmart App Banners <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode Attributes6.4 Medium
- yocoadmin yoco paymentsYoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read7.5 High
- xfinitysoft reviewify — review discounts & photo/video reviews for woocommerceReviewify <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creation7.5 High
- mamurjor employee infoMamurjor Employee Info <= 1.0.0 - Cross-Site Request Forgery to Arbitrary Employee and Related Data Manipulation4.3 Medium
- aharonyan guest posting / frontend posting / front editor – wp front user submitGuest posting / Frontend Posting / Front Editor – WP Front User Submit <= 5.0.0 - Missing Authorization to Unauthenticated Media Deletion5.3 Medium
- praveentamil sticky action buttonsSticky Action Buttons <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- mstoic shortcodesMstoic Shortcodes <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start' Shortcode Attribute6.4 Medium
- ruhul amin my album galleryMy Album Gallery <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style_css' Shortcode Attribute6.4 Medium
- damienoh wp widget changerWP Widget Changer <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- viitorcloudvc viitor button shortcodesViitor Button Shortcodes <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute6.4 Medium
- www15to qr code for woocommerce order emails, pdf invoices, packing slipsQR Code for WooCommerce order emails, PDF invoices, packing slips <= 1.9.42 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode Attributes6.4 Medium
- mattiaspkallio snillrik restaurant menuSnillrik Restaurant <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'menu_style' Shortcode Attribute6.4 Medium
- spwebguy responsive pricing tableResponsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- cuvixsystem post like dislikePost Like Dislike <= 1.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']6.1 Medium
- matiasanca cool yt playerCool YT Player <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- nahian91 awesome hotel bookingAwesome Hotel Booking <= 1.0.3 - Incorrect Authorization to Unauthenticated Arbitrary Booking Modification5.3 Medium
- djrowling niche hero | beautifully-designed blocks in secondsNiche Hero | Beautifully-designed blocks in seconds <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'spacing' Shortcode Attribute6.4 Medium
- wisdmlabs ai chatbot for wordpress by ai botkit – live in 2 minutes, no codeAI BotKit <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes6.4 Medium
- callumalden starred reviewStarred Review <= 1.4.2 - Reflected Cross-Site Scripting via PHP_SELF Variable6.1 Medium
- pichel wp js list pages shortcodesWP Js List Pages Shortcodes <= 1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute6.4 Medium
- Show moreLoading…