Skip to contentUnknown vulnerabilities
Newest
- unknown yith woocommerce wishlist, yith woocommerce wishlist +1 moreYITH WooCommerce Wishlist < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDORCVE-2026-44326.5 Medium
- unknown yml for yandex marketYML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed GenerationCVE-2025-145456.5 Medium
- automattic activitypubActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts DisclosureCVE-2026-43387.5 High
- firelightwp lightpress lightboxLightPress Lightbox <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group' Shortcode AttributeCVE-2026-43796.4 Medium
- guaven sql chart builderSQL Chart Builder < 2.3.8 - Unauthenticated SQL InjectionCVE-2026-40796.5 Medium
- linkwhisper link whisper, unknown link whisper free +1 moreLink Whisper Free < 0.9.1 - Unauthenticated Settings and User Meta UpdateCVE-2026-19006.5 Medium
- ays-pro popup boxPopup Box AYS Pro < 5.5.0 - Admin+ Stored Cross-Site Scripting (XSS) via CSRFCVE-2025-156115.4 Medium
- unknown spam protect for contact form 7Spam Protect for Contact Form 7 < 1.2.10 - Editor+ Remote Code ExecutionCVE-2026-15407.2 High
- unknown export all urlsExport All URLs < 5.1 - Unauthenticated Sensitive Data ExposureCVE-2026-26965.3 Medium
- unknown order notification for woocommerceOrder Notification for WooCommerce < 3.6.3 - Unauthenticated WooCommerce REST Permission BypassCVE-2025-154849.1 Critical
- unknown performance monitorPerformance Monitor <= 1.0.6 - Unauthenticated Blind SSRFCVE-2026-38815.8 Medium
- unknown restaurant cafeteriaRestaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/ActivationCVE-2025-154455.4 Medium
- unknown leadconnectorLeadConnector < 3.0.22 - Unauthenticated Rest CallCVE-2026-18905.3 Medium
- unknown wp lightbox 2WP Lightbox 2 < 3.0.7 - Admin+ Stored XSSCVE-2026-14304.8 Medium
- unknown responsive plusResponsive Plus < 3.4.3 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2025-154886.5 Medium
- unknown shared filesShared Files < 1.7.58 - Contributor+ Arbitrary File DownloadCVE-2025-154336.8 Medium
- icopydoc yml for yandex marketWordPress YML for Yandex Market plugin < 5.3.0 - Arbitrary File Deletion vulnerabilityCVE-2026-325676.8 Medium
- nysl spam protect for contact form 7WordPress Spam Protect for Contact Form 7 plugin <= 1.2.9 - Arbitrary File Deletion vulnerabilityCVE-2026-324966.8 Medium
- unknown peprodev ultimate invoicePeproDev Ultimate Invoice <= 2.2.5 - Unauthenticated Invoice Archive DownloadCVE-2026-23435.3 Medium
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLECVE-2026-31386.5 Medium
- unknown trx addonsThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File UploadCVE-2026-19695.3 Medium
- qrolic performance monitorPerformance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' ParameterCVE-2026-16487.2 High
- unknown get use apisGet Use APIs < 2.0.10 - Contributor+ Stored XSSCVE-2025-153635.9 Medium
- unknown reading progressbarReading progressbar < 1.3.1 - Admin+ Stored XSSCVE-2026-26874.3 Medium
- arraytics timeticsTimetics < 1.0.52 - Unauthenticated Payment/Booking Status UpdateCVE-2025-154734.3 Medium
- unknown easy mp3 downloader denial of serviceEasy MP3 Downloader 4.7.8.8 Denial of Service Buffer OverflowCVE-2019-254746.9 Medium
- unknown datalogics ecommerce deliveryDatalogics Ecommerce Delivery < 2.6.60 - Unauthenticated Privilege EscalationCVE-2026-2631Public exploit9.8 Critical
- unknown divi-boosterDivi Booster < 5.0.2 - Unauthenticated PHP Object InjectionCVE-2026-26268.1 High
- unknown dukapressDukaPress <= 3.2.4 - Reflected XSSCVE-2026-24667.1 High
- unknown guest posting / frontend posting / front editorWP Front User Submit < 5.0.6 - Unauthenticated Sensitive Information ExposureCVE-2026-18675.9 Medium
- unknown gutena formsGutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options UpdateCVE-2026-17536.8 Medium
- unknown court reservationCourt Reservation < 1.10.9 - Event Deletion via CSRFCVE-2026-15084.3 Medium
- unknown powerpack for learndashPowerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option UpdateCVE-2026-24469.8 Critical
- unknown wp ecommerceWP eCommerce <= 3.15.1 - Coupon Deletion via CSRFCVE-2026-11284.3 Medium
- unknown login with salesforceLogin with Salesforce <= 1.0.2 - Unauthenticated Authentication BypassCVE-2026-24189.1 Critical
- sagarpatel124 ooohboi steroids for elementorOoohBoi Steroids for Elementor <= 2.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL ControlsCVE-2026-30346.4 Medium
- unknown mail mintMail Mint < 1.19.5 - Unauthenticated Emails DisclosureCVE-2026-20257.5 High
- unknown super stage wpSuper Stage WP <= 1.0.1 - Unauthenticated PHP Object InjectionCVE-2026-15426.5 Medium
- dfactory responsive lightbox & galleryResponsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image UploadCVE-2026-24795.0 Medium
- unknown responsive lightbox & galleryResponsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored XSSCVE-2025-153868.8 High
- unknown conditional captchaConditional CAPTCHA <= 4.0.0 - Open RedirectCVE-2026-13694.3 Medium
- unknown subscribe2WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerabilityCVE-2026-249446.5 Medium
- spencer haws link whisper freeWordPress Link Whisper Free plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-223577.1 High
- ahachat messenger marketing, unknown ahachat messenger marketing +1 moreWordPress AhaChat Messenger Marketing plugin <= 1.1 - Broken Authentication vulnerabilityCVE-2025-688956.5 Medium
- anssi laitila shared filesWordPress Shared Files plugin <= 1.7.19 - Broken Access Control vulnerabilityCVE-2024-344385.3 Medium
- thimpress realpressWordPress RealPress plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-270505.4 Medium
- unknown leadconnectorWordPress LeadConnector plugin <= 3.0.21 - Broken Access Control vulnerabilityCVE-2026-254415.3 Medium
- bit apps form, unknown bit form +1 moreWordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerabilityCVE-2026-254187.6 High
- kaizencoders url shortifyWordPress URL Shortify plugin <= 1.12.3 - Server Side Request Forgery (SSRF) vulnerabilityCVE-2026-253855.5 Medium
- fooplugins foogalleryWordPress FooGallery plugin <= 3.1.11 - Broken Access Control vulnerabilityCVE-2026-253634.3 Medium
- Show moreLoading…