CVEs: o que está sendo explorado agora.
Dados do CVE Program (cve.org) e do catálogo KEV da CISA.
weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
boldgrid · weForms – Easy Drag & Drop Contact Form Builder For WordPressThe weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers…
Publicado em 17 de out. de 2026European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
davidanderson · European VAT Compliance Assistant for WooCommerceThe European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitr…
Publicado em 17 de out. de 2026YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
wssoffice21 · YMC FilterThe YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to…
Publicado em 17 de out. de 2026Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
stiofansisland · Payment forms, Buy now buttons, and Invoicing System | GetPaidThe Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attac…
Publicado em 17 de out. de 2026Registros novos ou atualizados na última hora, direto do repositório oficial do CVE Program. Podem ter pouco detalhe no início.