Skip to contentUnknown vulnerabilities
Newest
- till krüss email address encoder, unknown email-encoder-premium +1 moreEmail Address Encoder (Free < 1.0.25, Premium < 0.3.12) - Unauthenticated Stored XSSCVE-2026-53058.8 High
- unknown masteriyo lmsMasteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and DeletionCVE-2026-108246.5 Medium
- themeco cornerstoneThemeco Cornerstone < 7.8.8 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Password Hash DisclosureCVE-2026-97107.7 High
- themeco cornerstoneThemeco Cornerstone < 7.8.9 (Premium, bundled with X Theme) - Subscriber+ Arbitrary User Meta DisclosureCVE-2026-97097.7 High
- google site kit by googleSite Kit by Google < 1.176.0 - Editor+ Email Reporting Settings UpdateCVE-2026-107532.7 Low
- metaphor creations post duplicatorPost Duplicator < 3.0.15 - Contributor+ PHP Object Injection via customMetaDataCVE-2026-107497.2 High
- unknown product slider for woocommerce pro, real testimonials pro, smart-post-show-pro +2 moreShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update ServerCVE-2026-107357.5 High
- unknown ai share & summarizeAI Share & Summarize < 2.0.4 - Contributor+ Stored XSS via title_style Shortcode AttributeCVE-2026-105315.4 Medium
- joomunited wp meta seoWP Meta SEO <= 4.5.18 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI in 404 LoggingCVE-2026-96437.2 High
- joomunited wp meta seoWP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' ParameterCVE-2026-113706.4 Medium
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File DownloadCVE-2026-83797.5 High
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File RenameCVE-2026-83785.4 Medium
- unknown simple basic contact formSimple Basic Contact Form <= 20250114 - Reflected XSSCVE-2026-81727.1 High
- infility global, unknown infility global +1 moreInfility Global < 2.15.19 - Subscriber+ SQL Injection via order ParameterCVE-2026-81638.8 High
- infility global, unknown infility global +1 moreInfility Global < 2.15.20 - Editor+ SQL Injection via orderby ParameterCVE-2026-78426.8 Medium
- appsbd viteposVitepos < 3.4.2 - Outlet Manager+ Privilege EscalationCVE-2026-81578.8 High
- stylemixthemes motorsMotors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_mediaCVE-2026-78595.3 Medium
- unknown transbank webpayTransbank Webpay < 1.14.0 - Unauthenticated Stored XSSCVE-2026-68587.1 High
- unknown ultimate-woocommerce-auction-proUltimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_manage_auctionsCVE-2026-42597.1 High
- unknown ultimate-woocommerce-auction-proUltimate WooCommerce Auction Pro <= 2.4.5 - Reflected XSS via uwa_auctions_bids_listCVE-2026-41106.1 Medium
- genetech products pie registerPie Register < 3.8.4.10 - Unauthenticated Email Verification Bypass via Predictable TokenCVE-2026-105305.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX HandlersCVE-2026-98226.5 Medium
- dcooperman magicformMagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCECVE-2026-98156.5 Medium
- themeisle orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & moreOrbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' ParameterCVE-2026-113584.4 Medium
- ays pro popup boxWordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2026-541927.1 High
- alberto hornero clean loginWordPress Clean Login plugin <= 1.15 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-541848.2 High
- bookneticWordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerabilityCVE-2026-254398.1 High
- taskbuilderTaskbuilder < 5.0.8 - Reflected XSS via ShortcodeCVE-2026-95707.1 High
- thimpress learnpressLearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST APICVE-2026-83835.3 Medium
- unknown wemail: email marketing, email automation, newsletters, subscribers & email optins for woocommerceweMail < 2.1.3 - Reflected Cross-Site ScriptingCVE-2026-80897.1 High
- unknown wp magnific popupWP Magnific Popup <= 1.0 - Author+ Stored XSS via href AttributeCVE-2026-78505.9 Medium
- pods framework podsWordPress Pods plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-541917.1 High
- ninja team fastdupWordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerabilityCVE-2026-527039.6 Critical
- happyformsWordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerabilityCVE-2026-497689.8 Critical
- tammersoft shared filesWordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerabilityCVE-2026-491127.5 High
- glen don mongaya drag and drop multiple file upload – contact form 7WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-490557.1 High
- datalogics ecommerce delivery, unknown datalogics ecommerce delivery +1 moreWordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerabilityCVE-2026-395839.8 Critical
- themeisle social slider feedWordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-395077.1 High
- 10web form maker by 10webWordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerabilityCVE-2026-395029.3 Critical
- inisev backup migrationWordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerabilityCVE-2026-394807.5 High
- brainstorm force woocommerce cart abandonment recoveryWordPress WooCommerce Cart Abandonment Recovery plugin < 2.1.0 - Privilege Escalation vulnerabilityCVE-2026-394707.2 High
- codepeople form builder cpForm Builder CP < 1.2.47 - Editor+ Stored XSS via form_structureCVE-2026-92785.4 Medium
- flippercode wp maps proAdvanced Google Maps < 6.1.1 - Unauthenticated Administrator Account CreationCVE-2026-89359.8 Critical
- unknown wp go maps, wp go maps (formerly wp google maps) go maps +1 moreWP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker IDCVE-2026-83865.3 Medium
- unknown wp go maps, wp go maps (formerly wp google maps) go maps +1 moreWP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX FallbackCVE-2026-83855.3 Medium
- nickboss iptanus file uploadIptanus File Upload < 5.1.7 - File Overwrite via Race ConditionCVE-2025-155465.4 Medium
- agile logix store locator wordpressAgile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path TraversalCVE-2026-90623.4 Low
- agile logix store locator wordpressAgile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_nameCVE-2026-90613.5 Low
- unknown keepinmind dashboard notesKeepInMind - Dashboard Notes <= 0.8.5 - Contributor+ Stored XSSCVE-2026-9271Public exploit6.8 Medium
- ays-pro secure copy content protection and content lockingSecure Copy Content Protection and Content Locking < 5.1.5 - Admin+ Stored XSS via ays_sccp_sub_icon_image ParameterCVE-2026-92693.5 Low
- Show moreLoading…