📋 ADVISORIES
- 📄 Source for Jeg Kit for Elementor plugin <= 3.2.19 hit by unauthenticated stored XSS (CVE-2026-100180) — wordfence.com
🔓 CVEs & KEV
CVE-2026-97644 — trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation — CVSS 8.8 — Groundhogg through 4.9 - Authenticated (Sales Person+) Privilege Escalation via Co...
CVE-2026-93428 — ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — CVSS 7.5 — Ultimate Member through 2.13.1 - Missing Authorization to Unauthenticated Sensitiv...
CVE-2026-96270 — ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin — CVSS 7.2 — Ultimate Member through 2.13.1 - Unauthenticated Stored Cross-Site Scripting via '...
CVE-2026-94539 — psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent — CVSS 6.5 — SupportCandy through 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' P...
CVE-2026-95865 — beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder — CVSS 6.5 — Beaver Builder Page Builder through 2.11.0.5 - Authenticated (Contributor+) SQL In...
CVE-2026-94378 — psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent — CVSS 6.4 — SupportCandy through 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripti...