NVD disclosure day

Published threat advisories for October 14, 2026

CVE advisoryCRITICAL

CVE-2026-97668

Abandoned Cart Pro for WooCommerce SQL Injection Allows Administrator Account Escalation.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

A SQL injection vulnerability exists in the Abandoned Cart Pro for WooCommerce plugin, potentially allowing unauthenticated attackers to escalate privileges by appending SQL to a database update query. This could enable unauthorized access to sensitive information and modification of user account roles, including escal

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2026-97657

Abandoned Cart Pro Authentication Bypass Account Takeover

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

The Abandoned Cart Pro for WooCommerce plugin for WordPress has a critical vulnerability that allows unauthenticated attackers to bypass authentication and take over any user account, including administrators. This is achieved by exploiting weaknesses in the plugin's handling of cart recovery links, enabling attackers

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2026-110447

Nextcloud Collabora CODE Server OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A vulnerability exists in the Collabora Online Built-in CODE Server for Nextcloud, allowing remote code execution when the server is not running. This OS command injection flaw in `proxy.php` can be exploited by unauthenticated attackers, potentially impacting server integrity and availability. Organizations using this

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2026-110002

Snazzy Social Media Feed Arbitrary File Upload Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A vulnerability exists in the Snazzy Social Media Feed WordPress plugin that allows attackers to upload and execute arbitrary files, potentially leading to remote code execution. This is due to insufficient security checks and input sanitization in a script accessible without loading WordPress.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2026-93388

Printcart Store WooCommerce Plugin Arbitrary File Upload Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability in the Printcart Store WooCommerce plugin allows unauthenticated attackers to upload and execute arbitrary code by exploiting an image upload flaw. This could lead to a compromise of the e-commerce site. Technical leaders should verify the plugin's presence and reachability to plan remediation.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2026-92097

WordPress Click to Chat Arbitrary Shortcode Execution.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

The Click to Chat for WhatsApp WordPress plugin has a critical vulnerability allowing unauthenticated attackers to execute arbitrary shortcodes. This occurs because user-supplied data from a URL is not properly sanitized before being processed, enabling malicious commands to run on archive pages. This could impact webs

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2026-110392

Samsung QA-Board OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

Samsung QA-Board has an OS command injection vulnerability due to improper handling of special elements in commands. If reachable, an attacker could execute arbitrary commands on affected systems, potentially leading to a full compromise. Confirming the presence and exposure of QA-Board in your environment is crucial f

NVD modified: NVD date unavailable