| CVE/PSC | Application | Date | Affected versions | Description |
|---|---|---|---|---|
| Actual on: Nov 01, 2026, 15:11:50 | ||||
|
Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
vulnerable
|
Nov 01, 2026, 20:11:12 |
Min -
Max 1.0.66
|
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65. | |
|
WP BASE Booking of Appointments, Services and Events
vulnerable
|
Nov 01, 2026, 19:11:28 |
Min -
Max 6.5.2
|
Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. | |
|
Majestic Support – Help Desk & Support Plugin
vulnerable
|
Nov 01, 2026, 18:11:37 |
Min -
Max 1.2.3
|
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns (array keys)' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be us... | |
|
vulnerable
|
Nov 01, 2026, 17:11:57 |
Min -
Max 2.4.7
|
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. | |
|
ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
vulnerable
|
Nov 01, 2026, 17:11:39 |
Min -
Max 3.12.2
|
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable on block themes (such as Twent... | |
|
vulnerable
|
Nov 01, 2026, 17:11:24 |
Min -
Max 7.8.5
|
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to... | |
|
vulnerable
|
Nov 01, 2026, 16:11:51 |
Min -
Max 2.12.6
|
The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'member[ID]' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existing Welcart shop-member account's email address and password by supplying that member's numeric ID, then authenticate as that member to achieve full account takeover. The only authentication barrier is a wp_verify_n... | |
|
vulnerable
|
Nov 01, 2026, 16:11:51 |
Min -
Max 2.12.6
|
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all versions up to, and including, 2.12.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is staged by an unauthenticated visitor who forges the ROBOT PAYMENT browser-return request, storing the malicious gid value in... | |
|
FormFlow- Intuitive Drag & Drop builder with Advanced Lead Magic
vulnerable
|
Nov 01, 2026, 16:11:43 |
Min -
Max 3.11.0
|
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, wh... | |
|
vulnerable
|
Nov 01, 2026, 16:11:38 |
Min -
Max 2.8.5
|
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the a... | |