CVEs published in November 2026
8,007 vulnerabilities, 689 critical, 12 exploited.
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability7.1 High
- aguila technologies wp customer areaWordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- aguila technologies wp customer areaWordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- advancedcoding wpdiscuzWordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability7.1 High
- miniorange saml sp single sign onWordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability7.5 High
- relywp simple cloudflare turnstileWordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability5.3 Medium
- roland murg wp booking systemWordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- doofinder for woocommerceWordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability7.5 High
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability7.1 High
- qt frameworkResource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer)2.7 Low
- wc lovers wcfm marketplaceWordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability7.5 High
- awesomemotive contact form by wpformsWordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- about time technologies herowatch goAbout Time Technologies｜Herowatch Go - Security Misconfiguration8.5 High
- about time technologies herowatch go serverAbout Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference8.7 High
- about time technologies herowatch miniAbout Time Technologies｜Herowatch Mini - Missing Authentication8.7 High
- zephyrproject zephyrMemory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service6.5 Medium
- zephyrproject zephyrsys_rand_get() silently returns an unwritten buffer when the entropy device is not ready4.8 Medium
- zephyrproject zephyrInverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory7.8 High
- zephyrproject zephyrBluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write8.3 High
- zephyrproject zephyrI2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers7.8 High
- zephyrproject zephyrTime-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode7.0 High
- zephyrproject zephyrUnvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory8.8 High
- zephyrproject zephyrBluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue5.7 Medium
- unknown vikwidgetsloaderVikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks6.8 Medium
- plugins360 all-in-one video galleryAll-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute6.8 Medium
- mra13 simple download monitorSimple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode2.7 Low
- metagauss eventprimeEventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override5.3 Medium
- gtmserver stape conversion trackingStape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path7.1 High
- shahjada premium packagesPremium Packages < 7.3.1 - Subscriber+ Guest Order Takeover5.4 Medium
- shahjada premium packagesPremium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR5.3 Medium
- shahjada premium packagesPremium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure3.7 Low
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting5.5 Medium
- unknown duplicator, duplicator-pro +1 moreDuplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore4.8 Medium
- unknown wp rosterWP Roster < 2.36 - Unauthenticated Roster Data Modification5.3 Medium
- unknown text typingText Typing < 2.2.2 - Contributor+ Stored XSS6.8 Medium
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files6.7 Medium
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path5.5 Medium
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID6.5 Medium
- shortpixel enable media replaceEnable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload6.4 Medium
- unknown duplicator, duplicator-pro +1 moreDuplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points5.3 Medium
- unknown duplicator, duplicator-pro +1 moreDuplicator < 5.1.0 - Reflected XSS via 'logname' Parameter5.8 Medium
- frogerme wp remote users syncWP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File3.7 Low
- metaphor creations post duplicatorPost Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure2.7 Low
- g5theme essential real estateEssential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR6.5 Medium
- unknown powerpack addons for elementor: widgets, form styler and templatesPowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import4.1 Medium
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard3.8 Low
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR3.8 Low
- seopressSEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings7.1 High
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action6.8 Medium
- masaakitanaka booking packageBooking Package < 1.7.34 - Unauthenticated Payment Bypass5.3 Medium
- Show moreLoading…