Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Vulnerability	Exploitation status	Fix	Provider	Affected product	Published	Severity

`CVE-2026-120850`WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderElementor	Affected productElementor Website Builder	Published11/07/2026	SeverityMedium
`CVE-2026-119493`WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderMetaphor Creations, LLC	Affected product
`CVE-2026-123960`TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow	Exploitation statusActively exploited	FixNo	ProviderTOTOLINK	Affected product
`CVE-2026-123959`TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow	Exploitation statusActively exploited	FixNo	ProviderTOTOLINK	Affected product
`CVE-2026-119507`WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability	Exploitation statusNot confirmed	FixYes	ProviderWPDeveloper	Affected productNotificationX
`CVE-2026-119473`WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability	Exploitation statusNot confirmed	FixYes	Providerproperfraction	Affected productProfilePress
`CVE-2026-119465`WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability	Exploitation statusNot exploited	FixYes	ProviderWPVibes	Affected product
`CVE-2026-121762`WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability	Exploitation statusNot exploited	FixYes	ProviderBlubrry Podcasting	Affected product
`CVE-2026-107616`Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint	Exploitation statusNot exploited	FixYes	Providermelograno
`CVE-2026-120532`wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms	Exploitation statusNot exploited	FixYes	Providertomdever	Affected product
`CVE-2026-95870`wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter	Exploitation statusNot exploited	FixYes	Providertomdever	Affected productwpForo Forum
`CVE-2026-119164`wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter	Exploitation statusNot exploited	FixYes	Providertomdever	Affected product
`CVE-2026-103900`WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter	Exploitation statusNot exploited	FixYes	Providerdenishua	Affected product
`CVE-2026-118784`WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name	Exploitation statusNot exploited	FixYes	Providerjohn-dagelmore	Affected product
`CVE-2026-104992`Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint	Exploitation statusNot exploited	FixYes	Providermelograno
`CVE-2026-119155`wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter	Exploitation statusNot exploited	FixYes	Providertomdever	Affected productwpForo Forum
`CVE-2026-120548`YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php	Exploitation statusNot exploited	FixYes	Providericopydoc
`CVE-2026-110004`wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter	Exploitation statusNot exploited	FixYes	Providertomdever	Affected product
`CVE-2026-120514`Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter	Exploitation statusNot exploited	FixYes	Providerdylanjkotze	Affected product
`CVE-2026-123464`WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderLiquid Web / StellarWP
`CVE-2026-119502`WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderBdThemes	Affected product
`CVE-2026-122668`WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProvidermyCred	Affected productmyCred
`CVE-2026-120853`WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderBrainstorm Force	Affected product
`CVE-2026-120852`WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability	Exploitation statusNot confirmed	FixYes	ProviderBrainstorm Force	Affected product
`CVE-2026-123469`WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability	Exploitation statusNot confirmed	FixYes	ProviderLiquid Web / StellarWP	Affected product
`CVE-2026-119491`WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderDavid Lingren	Affected product
`CVE-2026-61990`WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability	Exploitation statusNot confirmed	FixYes	ProviderWC Lovers	Affected productWCFM Membership
`CVE-2026-119484`WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability	Exploitation statusNot exploited	FixYes	ProviderSupsystic	Affected product
`CVE-2026-120847`WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWpmet	Affected productMetform
`CVE-2026-119511`WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderSaeed	Affected product
`CVE-2026-121766`WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderBlubrry Podcasting	Affected product
`CVE-2026-123466`WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderLeapWorx	Affected product
`CVE-2026-121768`WordPress Contact Form 7 – Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderMarkus Wiesenhofer	Affected product
`CVE-2026-52713`WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderThimPress	Affected productLearnPress
`CVE-2026-119467`WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWPVibes	Affected productAnyWhere Elementor
`CVE-2026-66669`WordPress Superb Addons: Blocks, Patterns & theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability	Exploitation statusNot exploited	FixYes	ProviderSuplugins	Affected product
`CVE-2026-119510`WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderSaeed	Affected product
`CVE-2026-123958`TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow	Exploitation statusActively exploited	FixNo	ProviderTOTOLINK	Affected product
`CVE-2026-121781`WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWP ManageNinja LLC	Affected product
`CVE-2026-119489`WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderBootstrapped Ventures	Affected product
`CVE-2026-120849`WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability	Exploitation statusNot confirmed	FixYes	ProviderWC Lovers	Affected productWCFM Marketplace
`CVE-2026-120848`WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderWC Lovers	Affected product
`CVE-2026-124274`WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProvidermyCred	Affected productmyCred
`CVE-2026-122675`WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability	Exploitation statusNot exploited	FixYes	ProviderWpmet	Affected productWp Social
`CVE-2026-121761`WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability	Exploitation statusNot confirmed	FixYes	ProviderInfomaniak Network	Affected product
`CVE-2026-121767`WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability	Exploitation statusNot confirmed	FixYes	ProviderweDevs	Affected product
`CVE-2026-121778`WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWP Lab	Affected product
`CVE-2026-121779`WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability	Exploitation statusNot exploited	FixYes	ProviderYITH	Affected product
`CVE-2026-39733`WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability	Exploitation statusNot confirmed	FixYes	Providerproperfraction	Affected productProfilePress
`CVE-2026-104738`Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters	Exploitation statusNot exploited	FixYes	Providernasirahmed	Affected product

421,264 Results | Page 10 of 8,426

Vulnerability Database

Vulnerabilities

Top 5 providers by vulnerabilities (90 days)

Run an in-depth assessment with complete web risk management

Explore more resources from CyStack

Website security reports

CyStack research

Filters

Cybersecurity knowledge