BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more

CVE Radar:Know what’s exposed. Fix what matters.

Every published CVE with its CVSS severity, CISA known-exploited status and EPSS exploit probability — pulled from NVD, CVE.org, CISA KEV and FIRST, and refreshed hourly.

  1. Published this week2,94693% have a severity scoreCVE.org · NVDAll new CVEs
  2. Likely to be exploited1New this week with EPSS ≥ 10%FIRST EPSSEPSS explained
  3. Known exploited1,768+34 in last 30 daysCISA KEVKEV tracker

7 days to Nov 5, 2026 · updated 07:44 UTC

54,471 CVEs published in the 120 days to Nov 5, 2026 · page 15 of 2,179

  1. PublishedNov 5, 2026
    CVE-2026-855704.3 MEDIUM
    The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.
    ScoreSeverityVersionVector String
    4.3MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  2. PublishedNov 5, 2026
    CVE-2026-853515.0 MEDIUM
    The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.
    ScoreSeverityVersionVector String
    5.0MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
  3. PublishedNov 5, 2026
    CVE-2026-853476.8 MEDIUM
    The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.
    ScoreSeverityVersionVector String
    6.8MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
  4. PublishedNov 5, 2026
    CVE-2026-853464.3 MEDIUM
    The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
    ScoreSeverityVersionVector String
    4.3MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  5. PublishedNov 5, 2026
    CVE-2026-192569.8 CRITICAL
    The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
    ScoreSeverityVersionVector String
    9.8CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  6. PublishedNov 5, 2026
    CVE-2026-163048.1 HIGH
    The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
    ScoreSeverityVersionVector String
    8.1HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
  7. PublishedNov 5, 2026
    CVE-2026-1230148.7 HIGH
    iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker to execute arbitrary commands with the privileges of the logged-in user by inducing the user to open a crafted URL in iTerm2. Percent-encoded NUL characters survive input sanitization and are subsequently converted to whitespace during command-line parsing, allowing injection of additional arguments to /usr/bin/man. An attacker can inject the -P option to select an attacker-controlled pager command. NOTE: this issue exists because of an incomplete fix for CVE-2023-46321.
    ScoreSeverityVersionVector String
    8.7HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  8. PublishedNov 5, 2026
    CVE-2026-1091507.1 HIGH
    The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
    ScoreSeverityVersionVector String
    7.1HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
  9. PublishedNov 5, 2026
    CVE-2026-1077873.1 LOW
    The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
    ScoreSeverityVersionVector String
    3.1LOW3.1CISA-ADPCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
  10. PublishedNov 5, 2026
    CVE-2026-1077866.8 MEDIUM
    The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
    ScoreSeverityVersionVector String
    6.8MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
  11. PublishedNov 5, 2026
    CVE-2026-1077752.7 LOW
    The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
    ScoreSeverityVersionVector String
    2.7LOW3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
  12. PublishedNov 5, 2026
    CVE-2026-1077745.3 MEDIUM
    The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.
    ScoreSeverityVersionVector String
    5.3MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  13. PublishedNov 5, 2026
    CVE-2026-1077736.5 MEDIUM
    The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.
    ScoreSeverityVersionVector String
    6.5MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  14. PublishedNov 5, 2026
    CVE-2026-1059715.3 MEDIUM
    The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
    ScoreSeverityVersionVector String
    5.3MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  15. PublishedNov 5, 2026
    CVE-2026-1052596.8 MEDIUM
    The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
    ScoreSeverityVersionVector String
    6.8MEDIUM3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
  16. PublishedNov 5, 2026
    CVE-2026-1001449.3 CRITICAL
    The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
    ScoreSeverityVersionVector String
    9.3CRITICAL3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
  17. PublishedNov 5, 2026
    CVE-2025-157028.8 HIGH
    The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  18. PublishedNov 5, 2026
    CVE-2025-157013.5 LOW
    The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.
    ScoreSeverityVersionVector String
    3.5LOW3.1CISA-ADPCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
  19. PublishedNov 5, 2026
    CVE-2026-933898.2 HIGH
    The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.
    ScoreSeverityVersionVector String
    8.2HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
  20. PublishedNov 5, 2026
    CVE-2026-1230127.1 HIGH
    In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of a case-sensitivity desync between the authorization classifier and the request dispatcher: the gitHTTPIsPull function compares the Git action verb case-sensitively and defaults to pull (read access) for any unrecognized string, whereas the request dispatcher lowercases the same verb before routing it to the receive-pack handler. Capitalizing a single letter in the URL (e.g. info/Refs instead of info/refs, or git-receive-Pack instead of git-receive-pack) causes the classifier to misidentify a push as a pull, granting only read-level authorization, whereas the dispatcher routes it to the write handler. An authenticated read-only collaborator can exploit this to push to a private repository, creating, updating, or deleting refs.
    ScoreSeverityVersionVector String
    7.1HIGH4.0CNACVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N
  21. PublishedNov 5, 2026
    CVE-2026-1230114.2 MEDIUM
    STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.
    ScoreSeverityVersionVector String
    4.2MEDIUM3.1CNACVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
  22. PublishedNov 5, 2026
    CVE-2026-1230107.2 HIGH
    @twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.
    ScoreSeverityVersionVector String
    7.2HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
  23. PublishedNov 5, 2026
    CVE-2026-1205536.4 MEDIUM
    The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_show' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
    ScoreSeverityVersionVector String
    6.4MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  24. PublishedNov 5, 2026
    CVE-2026-1205336.4 MEDIUM
    The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the host theme to have registered a Redux field of a CSS-emitting type (such as link_color, border, or typography) with an output CSS selector, as only the field types 'spinner', 'slider', 'color', and 'date' receive per-type value validation that would block the entity-encoded payload.
    ScoreSeverityVersionVector String
    6.4MEDIUM3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  25. PublishedNov 5, 2026
    CVE-2026-1181938.8 HIGH
    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()` function applying only a narrow literal check against the string `'administrator'` rather than enforcing the plugin's own `give_get_donor_safe_user_roles()` allowlist on save, and due to the `give_core_settings_import_callback()` AJAX handler writing imported JSON directly into the `give_settings` option via `update_option()` without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager role (holding the `manage_give_settings` capability) and above to configure donor registration to assign privileged WordPress roles — up to and including Administrator via the import path — to every new donor account created through the platform. Via the settings save path, the Administrator role is blocked but any other elevated role (Editor, Author, etc.) is accepted; via the Tools › Import JSON path, the sanitize filter is bypassed entirely, allowing the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts.
    ScoreSeverityVersionVector String
    8.8HIGH3.1CNACVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:36 UTC.