Skip to content
Unknown vulnerabilities
Newest
-
elliotvs simple captcha with cloudflare turnstile
Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
CVE-2026-93900
6.4 Medium
-
unknown vikwidgetsloader
VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks
CVE-2026-118983
6.8 Medium
-
plugins360 all-in-one video gallery
All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute
CVE-2026-118783
6.8 Medium
-
mra13 simple download monitor
Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode
CVE-2026-118637
2.7 Low
-
metagauss eventprime
EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override
CVE-2026-118523
5.3 Medium
-
gtmserver stape conversion tracking
Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path
CVE-2026-118422
7.1 High
-
shahjada premium packages
Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
CVE-2026-118407
5.4 Medium
-
shahjada premium packages
Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
CVE-2026-118404
5.3 Medium
-
shahjada premium packages
Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
CVE-2026-118403
3.7 Low
-
unknown wpvivid — backup, migration & staging
WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting
CVE-2026-115426
5.5 Medium
-
unknown duplicator, duplicator-pro +1 more
Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore
CVE-2026-115262
4.8 Medium
-
unknown wp roster
WP Roster < 2.36 - Unauthenticated Roster Data Modification
CVE-2026-115257
5.3 Medium
-
unknown text typing
Text Typing < 2.2.2 - Contributor+ Stored XSS
CVE-2026-115250
6.8 Medium
-
unknown wpvivid — backup, migration & staging
WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_upload_import_files
CVE-2026-115243
6.7 Medium
-
unknown wpvivid — backup, migration & staging
WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path
CVE-2026-115242
5.5 Medium
-
unknown wpvivid — backup, migration & staging
WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID
CVE-2026-115241
6.5 Medium
-
shortpixel enable media replace
Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
CVE-2026-114431
6.4 Medium
-
unknown duplicator, duplicator-pro +1 more
Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points
CVE-2026-112244
5.3 Medium
-
unknown duplicator, duplicator-pro +1 more
Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter
CVE-2026-112243
5.8 Medium
-
frogerme wp remote users sync
WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File
CVE-2026-111962
3.7 Low
-
metaphor creations post duplicator
Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure
CVE-2026-111740
2.7 Low
-
g5theme essential real estate
Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR
CVE-2026-110964
6.5 Medium
-
unknown powerpack addons for elementor: widgets, form styler and templates
PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV Import
CVE-2026-110692
4.1 Medium
-
fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 more
FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard
CVE-2026-108068
3.8 Low
-
fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 more
FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR
CVE-2026-108067
3.8 Low
-
seopress
SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings
CVE-2026-108041
7.1 High
-
unknown kali forms — contact form & drag-and-drop builder
Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action
CVE-2026-106649
6.8 Medium
-
masaakitanaka booking package
Booking Package < 1.7.34 - Unauthenticated Payment Bypass
CVE-2026-106000
5.3 Medium
-
unknown form maker by 10web
Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values
CVE-2026-105413
7.5 High
-
unknown erp: complete hr, accounting & crm suite built for woocommerce
WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log
CVE-2026-105191
4.3 Medium
-
unknown cookieyes
CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts
CVE-2026-104719
6.4 Medium
-
mollie payments for woocommerce, unknown mollie payments for woocommerce +1 more
Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order
CVE-2026-101166
3.7 Low
-
mollie payments for woocommerce, unknown mollie payments for woocommerce +1 more
Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay
CVE-2026-101165
3.7 Low
-
eupago gateway for woocommerce, unknown eupago gateway for woocommerce +1 more
Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypass
CVE-2026-91075
5.3 Medium
-
unknown cryptocloud
CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secret
CVE-2026-103327
5.3 Medium
-
unknown wemail
weMail <= 2.1.6 - Editor+ API Key Disclosure
CVE-2026-104648
4.9 Medium
-
unknown wemail
weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()
CVE-2026-104647
3.8 Low
-
hieu nguyen wati chat and notification
WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token
CVE-2026-103379
5.3 Medium
-
unknown dt lms
DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation
CVE-2026-106004
5.3 Medium
-
unknown dt directory lite addon
DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update
CVE-2026-105993
5.3 Medium
-
ghozylab gallery for social photo
Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter
CVE-2026-105967
5.8 Medium
-
unknown azexo store locator
AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_item
CVE-2026-115205
6.5 Medium
-
acf extended advanced custom fields: extended pro
Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type
CVE-2026-120534
9.8 Critical
-
unknown payhere payment gateway
PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification
CVE-2026-103310
5.3 Medium
-
nickboss wordpress file upload
WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-66570
7.1 High
-
liquid web / stellarwp bookit
WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability
CVE-2026-62048
9.3 Critical
-
unknown mappress
MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure
CVE-2026-118168
5.3 Medium
-
david lingren media library assistant
Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute
CVE-2026-113482
6.8 Medium
-
david lingren media library assistant
Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields
CVE-2026-113481
4.3 Medium
-
unknown kali forms — contact form & drag-and-drop builder
Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing
CVE-2026-107343
4.3 Medium
- Show olderLoading…