| CVE-2026-57355 | Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions. | medium | 2026-10-25 |
| CVE-2026-57354 | Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions. | medium | 2026-10-25 |
| CVE-2026-57353 | Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions. | medium | 2026-10-25 |
| CVE-2026-57352 | Unauthenticated Broken Authentication in ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce <= 2.2.0 versions. | medium | 2026-10-25 |
| CVE-2026-57351 | Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions. | high | 2026-10-25 |
| CVE-2026-57350 | Unauthenticated Cross Site Scripting (XSS) in WP Debugging <= 2.12.2 versions. | high | 2026-10-25 |
| CVE-2026-57349 | Unauthenticated Cross Site Scripting (XSS) in WPeMatico RSS Feed Fetcher <= 2.8.17 versions. | high | 2026-10-25 |
| CVE-2026-57348 | Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions. | high | 2026-10-25 |
| CVE-2026-57347 | Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions. | medium | 2026-10-25 |
| CVE-2026-57346 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epiphyt Embed Privacy allows Path Traversal. This issue affects Embed Privacy: from n/a through 1.12.3. | high | 2026-10-25 |
| CVE-2026-57345 | Unauthenticated Cross Site Scripting (XSS) in Internal Links Manager <= 3.0.3 versions. | high | 2026-10-25 |
| CVE-2026-57344 | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions. | high | 2026-10-25 |
| CVE-2026-57343 | Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. | high | 2026-10-25 |
| CVE-2026-57342 | Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions. | medium | 2026-10-25 |
| CVE-2026-57341 | Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 versions. | medium | 2026-10-25 |
| CVE-2026-57340 | Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions. | medium | 2026-10-25 |
| CVE-2026-57339 | Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions. | medium | 2026-10-25 |
| CVE-2026-57338 | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. | high | 2026-10-25 |
| CVE-2026-57337 | Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions. | high | 2026-10-25 |
| CVE-2026-57336 | Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions. | high | 2026-10-25 |
| CVE-2026-57335 | Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions. | medium | 2026-10-25 |
| CVE-2026-57334 | Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions. | medium | 2026-10-25 |
| CVE-2026-57333 | Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 versions. | high | 2026-10-25 |
| CVE-2026-57332 | Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions. | high | 2026-10-25 |
| CVE-2026-57331 | Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions. | critical | 2026-10-25 |
| CVE-2026-57330 | Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions. | medium | 2026-10-25 |
| CVE-2026-57328 | Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. | medium | 2026-10-25 |
| CVE-2026-57326 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. | medium | 2026-10-25 |
| CVE-2026-57325 | Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions. | high | 2026-10-25 |
| CVE-2026-57324 | Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions. | medium | 2026-10-25 |
| CVE-2026-57323 | Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions. | medium | 2026-10-25 |
| CVE-2026-57322 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs weMail wemail allows Reflected XSS.This issue affects weMail: from n/a through 2.1.2. | high | 2026-10-25 |
| CVE-2026-57321 | Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions. | high | 2026-10-25 |
| CVE-2026-57320 | Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions. | high | 2026-10-25 |
| CVE-2026-57319 | Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions. | high | 2026-10-25 |
| CVE-2026-57318 | Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. | medium | 2026-10-25 |
| CVE-2026-57317 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.2 versions. | high | 2026-10-25 |
| CVE-2026-57316 | Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions. | medium | 2026-10-25 |
| CVE-2026-57315 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions. | high | 2026-10-25 |
| CVE-2026-57312 | Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions. | high | 2026-10-25 |
| CVE-2026-57307 | A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | medium | 2026-10-25 |
| CVE-2026-57306 | A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | medium | 2026-10-25 |
| CVE-2026-57305 | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL using an attacker-specified username and password. | medium | 2026-10-25 |
| CVE-2026-57304 | A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password. | medium | 2026-10-25 |
| CVE-2026-57303 | Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery. | high | 2026-10-25 |
| CVE-2026-57302 | Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system. | medium | 2026-10-25 |
| CVE-2026-57301 | Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller. | high | 2026-10-25 |
| CVE-2026-57300 | A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access. | medium | 2026-10-25 |
| CVE-2026-5730 | Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026. | high | 2026-10-25 |
| CVE-2026-57299 | Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata. | medium | 2026-10-25 |
