CVSS - zero redgem

Recent Advisories

Severity	ID	Title	Vendor	Product	Date	Type
HIGH 7.5	CVE-2026-9178	WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint_CVE-2026-9178 The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers t...	hancock11	WP Forms Connector	Jun 24, 2026	CVE
MEDIUM 5.3	CVE-2026-9175	Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter_CVE-2026-9175 The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to, a...	ajitdas	Devs Accounting – Simple Accounting and Invoicing Solution	Jun 24, 2026	CVE
MEDIUM 5.3	CVE-2026-9172	Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint_CVE-2026-9172 The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modification/deletion of data due...	ajitdas	Devs Accounting – Simple Accounting and Invoicing Solution	Jun 24, 2026	CVE
MEDIUM 6.1	CVE-2026-8905	Osiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter_CVE-2026-8905 The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due...	osiris8	Osiris Signature Banner	Jun 24, 2026	CVE
MEDIUM 6.4	CVE-2026-8896	MIR blocks and shortcodes <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes_CVE-2026-8896 The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute (and other attributes suc...	mirsoftware	MIR blocks and shortcodes	Jun 24, 2026	CVE
MEDIUM 6.4	CVE-2026-8865	Avalon23 Products Filter for WooCommerce <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes_CVE-2026-8865 The Avalon23 Products Filter for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'avalon23_qr' shortcode in a...	paradigmatools	Avalon23 Products Filter for WooCommerce	Jun 24, 2026	CVE
HIGH 7.5	CVE-2026-8705	ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection_CVE-2026-8705 The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJ...	clearsale	ClearSale Total <= 3.4.2	Jun 24, 2026	CVE
MEDIUM 5.3	CVE-2026-8690	RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action_CVE-2026-8690 The RentMy Real-Time Rental Management Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0....	rentmy	RentMy Real-Time Rental Management Plugin	Jun 24, 2026	CVE
MEDIUM 4.3	CVE-2026-8688	Advance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action_CVE-2026-8688 The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to t...	krishaweb	Advance Nav Menu Manager	Jun 24, 2026	CVE
MEDIUM 6.1	CVE-2026-8628	EntreDroppers <= 1.1.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter_CVE-2026-8628 The EntreDroppers plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including,...	owencutajar	EntreDroppers	Jun 24, 2026	CVE