Skip to contentUnknown vulnerabilities
Newest
- beardev joomsportWordPress JoomSport plugin <= 5.7.7 - SQL Injection vulnerabilityCVE-2026-42647Public exploit9.3 Critical
- berocket advanced ajax product filtersWordPress Advanced AJAX Product Filters plugin <= 1.6.3.3 - Broken Access Control + CSRFCVE-2022-458135.4 Medium
- unknown wp mail logWordPress WP Mail Log plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2023-339997.1 High
- unknown wpzoom portfolio, wpzoom portfolio +1 moreWordPress WPZOOM Portfolio plugin <= 1.4.21 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-49069Public exploit7.1 High
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media UploadCVE-2026-9067Public exploit9.1 Critical
- agile logix store locator wordpressAgile Store Locator < 1.6.6 - Admin+ Stored XSS via map_styleCVE-2026-90603.5 Low
- unknown anti-spam by cleantalk. spam protectionSpam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode BypassCVE-2026-80718.8 High
- 8theme xstoreXStore < 9.7.3 - Unauthenticated SQLiCVE-2026-3326Public exploit8.6 High
- unknown custom block builderLazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTMLCVE-2026-89813.5 Low
- syed balkhi wpformsWPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook ForgeryCVE-2026-49865.3 Medium
- unknown recipe card blocks liteRecipe Card Blocks Lite <= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes'CVE-2026-30116.4 Medium
- maxfoundry wp-paginateWordPress Plugin WP-Paginate 2.1.3 Stored XSS via presetCVE-2021-479825.1 Medium
- chrisvrichardson mappress maps for wordpressMapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Reference via REST API EndpointsCVE-2026-88395.3 Medium
- codepress admin columnsAdmin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta ValueCVE-2026-7654Public exploit8.8 High
- liquid web / stellarwp bookitWordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerabilityCVE-2026-407807.5 High
- den-media hiweb migration simplehiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting via 'new_domain' ParameterCVE-2026-24256.1 Medium
- unknown really simple securityReally Simple Security < 9.5.10.1 - Authentication Bypass via Two-Factor OTP SkipCVE-2026-82937.5 High
- unknown contest gallery proWordPress Contest Gallery Pro plugin <= 29.0.1 - Privilege Escalation vulnerabilityCVE-2026-426809.8 Critical
- ninjew geo my wpGEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' ParametersCVE-2026-97577.5 High
- linkwhspr link whisper freeLink Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site ScriptingCVE-2025-11262Public exploit7.2 High
- statcounter – free real time visitor stats, unknown statcounter – free real time visitor stats +1 moreStatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author NicknameCVE-2026-62756.4 Medium
- eupago gateway for woocommerce, unknown eupago gateway for woocommerce +1 moreEupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund InitiationCVE-2026-78628.6 High
- jetmonsters timetable and event schedule by motopressTimetable and Event Schedule by MotoPress <= 2.4.16 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data FunctionCVE-2026-92284.3 Medium
- robertpeake login no captcha recaptchaLogin No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELFCVE-2026-23747.2 High
- benbodhi svg supportWordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerabilityCVE-2026-489734.3 Medium
- duogeek eventpressEventPress < 22.2 – Reflected Cross-Site ScriptingCVE-2026-62687.1 High
- storeapps smart managerWordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerabilityCVE-2026-452168.8 High
- unknown flextableWordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerabilityCVE-2026-245824.3 Medium
- nikki blight qr redirectorWordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerabilityCVE-2026-245454.3 Medium
- unknown mail mintWordPress Mail Mint plugin <= 1.19.5 - Sensitive Data Exposure vulnerabilityCVE-2026-273494.3 Medium
- unknown decent commentsDecent Comments < 3.0.2 - Unauthenticated Email Address DisclosureCVE-2026-73855.8 Medium
- unknown email encoderEmail Encoder < 2.4.7 - Unauthenticated Stored XSSCVE-2026-57766.1 Medium
- goback2 logo manager for enamadLogo Manager For Enamad <= 0.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode AttributeCVE-2026-65496.4 Medium
- fortispay fortis for woocommerceFortis For WooCommerce < 1.3.1 - Sensitive API Key DisclosureCVE-2025-156097.5 High
- darren cooney ajax load moreAjax Load More < 7.8.4 - Reflected XSSCVE-2026-64957.1 High
- unknown wp mapsWP Maps < 4.9.3 - Subscriber+ Local File InclusionCVE-2026-63817.5 High
- opajaap wp photo album plusWP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' ParameterCVE-2026-6379Public exploit8.6 High
- creative motion clearfy cache, optimizingmatters autoptimize, siteground speed optimizer +2 moreMultiple Plugins - Unauthenticated Stored XSS via Minify LibraryCVE-2026-32208.8 High
- smub feeds for youtube (youtube video, channel, and gallery plugin)Feeds for YouTube < 2.6.4 - Subscriber+ License Data DeletionCVE-2026-16315.4 Medium
- unknown custom css-js-phpCustom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCECVE-2026-6433Public exploit7.3 High
- unknown ottokit: all-in-one automation platformSureTriggers < 1.1.23 – Unauthenticated SQLiCVE-2026-49358.6 High
- unknown magic export & importMagic Export & Import < 1.2.0 - Unauthenticated PII DisclosureCVE-2026-53355.3 Medium
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDORCVE-2026-53376.5 Medium
- unknown check & log emailCheck & Log Email < 2.0.13 - Unauthenticated Stored XSSCVE-2026-53065.4 Medium
- unknown recaptcha by webdesignbyWP reCaptcha by WebDesignBy < 2.0 – Admin+ Stored XSSCVE-2026-45123.5 Low
- unknown ht mega addons for elementorHT Mega < 3.0.7 – Unauthenticated PII DisclosureCVE-2026-4106Public exploit5.3 Medium
- unknown email encoderEmail Encoder < 2.3.4 - Admin+ Stored XSSCVE-2024-70833.5 Low
- essential plugin featured post creative, meta slider and carousel with lightbox, portfolio and projects +19 more +21 moreEssentialplugin Plugins (Various Versions) - Injected BackdoorCVE-2026-64439.8 Critical
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLiCVE-2026-38308.6 High
- unknown form maker by 10webForm Maker < 1.15.38 - SQL InjectionCVE-2025-154416.8 Medium
- Show moreLoading…