Skip to contentUnknown Yo vulnerabilities
- bplugins video player for youtubeYT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajaxCVE-2026-850073.8 Low
- unknown pixelyoursite, pixelyoursite pro +1 morePixelYourSite (Free & Pro) - Unauthenticated Stored XSS via CookieCVE-2026-1099877.2 High
- futtta wp youtube lyteWP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block AttributesCVE-2026-968956.8 Medium
- unknown masteriyo lmsMasteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key DisclosureCVE-2026-828504.3 Medium
- unknown masteriyo lmsMasteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDORCVE-2026-828494.3 Medium
- unknown yoYo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username ParameterCVE-2026-879638.6 High
- embeds for youtube plugin support youtube embedYouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_serverCVE-2026-887938.8 High
- unknown masteriyo lmsMasteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDORCVE-2026-828512.7 Low
- unknown masteriyo lmsMasteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course HighlightsCVE-2026-828476.8 Medium
- unknown masteriyo lmsMasteriyo LMS < 3.4.1 - Subscriber+ PHP Object InjectionCVE-2026-828459.9 Critical
- unknown yogeta wp cloudYogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File DownloadCVE-2026-804948.6 High
- unknown masteriyo lmsMasteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment DisclosureCVE-2026-828485.3 Medium
- bplugins video player for youtubeYT Player < 2.1.0 - Contributor+ SQLi via ytp_ajaxCVE-2026-849376.8 Medium
- unknown masteriyo lmsMasteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom FieldsCVE-2026-828466.8 Medium
- unknown yoast seo premiumYoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCECVE-2026-108216.6 Medium
- unknown masteriyo lmsMasteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz DescriptionCVE-2026-197126.1 Medium
- unknown wpc name your price for woocommerceWPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select ModeCVE-2026-166207.5 High
- unknown yop poll, yop poll +1 moreYOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header SpoofingCVE-2026-14840Public exploit5.3 Medium
- unknown masteriyo lmsMasteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)CVE-2026-133329.1 Critical
- stevejburge tag groups is the advanced way to display your taxonomy termsTag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' ParameterCVE-2026-9833Public exploit7.1 High
- unknown yoothemeYOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data AttributesCVE-2026-100776.8 Medium
- unknown applyonlineWordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerabilityCVE-2026-577215.3 Medium
- unknown masteriyo lmsMasteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and DeletionCVE-2026-108246.5 Medium
- smub feeds for youtube (youtube video, channel, and gallery plugin)Feeds for YouTube < 2.6.4 - Subscriber+ License Data DeletionCVE-2026-16315.4 Medium
- unknown pixelyoursitePixelYourSite < 11.1.2 - Admin+ LFICVE-2025-107232.7 Low
- travelpayouts, unknown travelpayouts: all travel brands in one place +1 moreTravelpayouts < 1.1.13 - Settings Update via CSRFCVE-2023-59347.3 High
- travelpayouts, unknown travelpayouts: all travel brands in one place +1 moreTravelpayouts < 1.1.14 - Reflected XSSCVE-2023-59324.8 Medium
- optimalaccess kbucket, unknown kbucket: your curated content in wordpress +1 morekbucket < 4.1.5 - Reflected XSSCVE-2024-66676.1 Medium
- optimalaccess kbucket, unknown kbucket: your curated content in wordpress +1 morekbucket < 4.1.6 - Admin+ Stored XSSCVE-2024-66654.8 Medium
- unknown applyonline, spiderteams applyonline - application form builder and manager +1 moreApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File AccessCVE-2024-100982.7 Low
- unknown s3bubble media streaming (aws|elementor|youtube|vimeo functionality), s3bubble s3bubble-amazon-web-services-oembed-media-streaming-support +1 moreS3Bubble Media Streaming <= 8.0 - Reflected XSSCVE-2024-138627.1 High
- pragmasoftwares google map professional, unknown wordpress google map professional (map in your language) +1 moreGoogle Map Professional <= 1.0 - Reflected XSSCVE-2024-132206.1 Medium
- farhan noor applyonlineWordPress ApplyOnline plugin <= 2.6.7.1 - Broken Access Control vulnerabilityCVE-2025-227214.3 Medium
- info-d-74 playlist for youtubePlaylist for Youtube <= 1.32 - Editor+ Stored XSSCVE-2024-39374.8 Medium
- travelpayouts, unknown travelpayouts: all travel brands in one place +1 moreTravelpayouts <= 1.1.15 - Open RedirectCVE-2024-03376.1 Medium
- spider teams applyonline, spiderteams applyonline - application form builder and manager +1 moreWordPress ApplyOnline – Application Form Builder and Manager Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)CVE-2023-243915.9 Medium
- themegrill masteriyo, unknown lms by masteriyo +1 moreLMS by Masteriyo < 1.6.8 - Information ExposureCVE-2023-33456.5 Medium
- punchcreative get your numberGet Your Number <= 1.1.3 - Admin+ Stored XSSCVE-2023-26344.8 Medium
- pixelyoursite product catalog feed by pixelyoursite, product catalog feed +1 moreProduct Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSSCVE-2023-18046.1 Medium
- pixelyoursite product catalog feed by pixelyoursite, product catalog feed +1 moreProduct Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSSCVE-2023-18056.1 Medium
- unknown klaviyo, klaviyo klavio +1 moreKlaviyo <= 3.0.10 - Admin+ Stored XSSCVE-2023-08744.8 Medium
- plugin yourchannel, pluginbuilders yourchannel: everything you want in a youtube plugin. +1 moreYourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation ResetCVE-2023-18715.4 Medium
- plugin yourchannel, pluginbuilders yourchannel: everything you want in a youtube plugin. +1 moreYourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Language Translation UpdateCVE-2023-18704.3 Medium
- plugin yourchannel, pluginbuilders yourchannel: everything you want in a youtube plugin. +1 moreYourChannel <= 1.2.5 - Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2023-18695.5 Medium
- plugin yourchannel, pluginbuilders yourchannel: everything you want in a youtube plugin. +1 moreYourChannel <= 1.2.3 - Missing Authorization to Plugin Cache ResetCVE-2023-18686.5 Medium
- plugin yourchannel, pluginbuilders yourchannel: everything you want in a youtube plugin. +1 moreYourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Settings ChangeCVE-2023-18675.4 Medium
- plugin yourchannel, pluginbuilders yourchannel: everything you want in a youtube plugin. +1 moreYourChannel <= 1.2.4 - Cross-Site Request Forgery to Plugin Channel ResetCVE-2023-18665.4 Medium
- plugin yourchannel, pluginbuilders yourchannel: everything you want in a youtube plugin. +1 moreYourChannel <= 1.2.3 - Missing Authorization to Plugin Settings ResetCVE-2023-18656.5 Medium
- gallerycreator gallery blocks with lightbox. image gallery, (html5 video , youtube, vimeo) video gallery and lightbox for native gallery, simplygallery simply gallery blocks with lightbox +1 moreGallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options UpdateCVE-2023-04418.1 High
- klaviyoWordPress Klaviyo Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)CVE-2023-254565.9 Medium
- Show olderLoading…