CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All sources

NVD Recent CVEs

Vulnerability databaseUS3,785 advisories1 exploitedlatest 2026-07-11synced 2026-07-11⚡ RSS feed official site ↗

The National Vulnerability Database (NVD), run by NIST, is the reference database for CVE records with CVSS scoring. It is a high-volume firehose rather than a curated advisory stream, so CSIRTS.com keeps it out of the default browse view but fully searchable — and uses it to build permanent CVE index records with severity and KEV status.

CSIRTS.com ingests NVD Recent CVEs every 3 hours, normalizes each advisory into a common schema and cross-references every CVE against the CISA KEV catalog and public exploit datasets. Publishes newly published and updated CVE records. Also available via RSS, JSON API and the MCP server.

Latest from NVD Recent CVEs

CVE-2026-57828: The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

unknownCVE-2026-578282026-07-11

CVE-2026-57827: The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

unknownCVE-2026-578272026-07-11

CVE-2026-1359: The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt() functio

highCVSS 8.8CVE-2026-13592026-07-11

CVE-2026-9282: The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for u

highCVSS 7.5CVE-2026-92822026-07-11

CVE-2026-9017: The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugi

mediumCVSS 5.3CVE-2026-90172026-07-11

CVE-2026-6939: The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including,

highCVSS 7.2CVE-2026-69392026-07-11

CVE-2026-6801: The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it pos

mediumCVSS 5.3CVE-2026-68012026-07-11

CVE-2026-4661: The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up

highCVSS 7.5CVE-2026-46612026-07-11

CVE-2026-1382: The fresh Podcaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'freshpodcaster' shortcode in all versions up to, and including, 1.0.7 due to insuffic

mediumCVSS 6.4CVE-2026-13822026-07-11

CVE-2026-15155: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all ve

highCVSS 8.8CVE-2026-151552026-07-11

CVE-2026-15010: The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is d

mediumCVSS 6.4CVE-2026-150102026-07-11

CVE-2026-12994: The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is due to the plugin not p

mediumCVSS 5.3CVE-2026-129942026-07-11

CVE-2026-12738: The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due t

mediumCVSS 4.3CVE-2026-127382026-07-11

CVE-2026-12126: The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment 'post_title' in all versions up to,

mediumCVSS 6.4CVE-2026-121262026-07-11

CVE-2026-12103: The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin not properly verifying

mediumCVSS 4.3CVE-2026-121032026-07-11

CVE-2026-11901: The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the `web_hook_

mediumCVSS 5.3CVE-2026-119012026-07-11

CVE-2026-11898: The White Label CMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.7.12 due to insufficient input sani

mediumCVSS 4.4CVE-2026-118982026-07-11

CVE-2026-11591: The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 13.3 due to insufficient i

mediumCVSS 4.4CVE-2026-115912026-07-11

CVE-2026-10865: The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it

mediumCVSS 5.3CVE-2026-108652026-07-11

CVE-2026-10041: The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm_product

mediumCVSS 4.3CVE-2026-100412026-07-11

CVE-2025-6784: The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin n

highCVSS 8.8CVE-2025-67842026-07-11

CVE-2025-5017: The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due t

mediumCVSS 4.9CVE-2025-50172026-07-11

CVE-2026-7655: The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validat

highCVSS 8.1CVE-2026-76552026-07-11

CVE-2026-13378: The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.

highCVSS 7.2CVE-2026-133782026-07-11

CVE-2026-9738: The Print, PDF, Email by PrintFriendly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content_position_css' parameter in all versions up to, and includi

mediumCVSS 4.4CVE-2026-97382026-07-11

Browse all 3,785 advisories from NVD Recent CVEs →