Skip to contentUnknown vulnerabilities
Newest
- unknown appointment booking calendar plugin and scheduling pluginBookingPress <= 1.1.28 - Unauthenticated PHP Object InjectionCVE-2026-123788.1 High
- unknown dologin securityDoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG TokenCVE-2026-144958.8 High
- unknown doleads integrator, wp2epub +1 moreDoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCECVE-2026-43759.0 Critical
- unknown uncanny-automator-proUncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update ServerCVE-2026-123759.8 Critical
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path TraversalCVE-2026-12277Public exploit8.7 High
- unknown wp travel engine, wp travel engine travel engine +1 moreWP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_imageCVE-2026-108344.6 Medium
- mndpsingh287 file manager, ninja team file manager pro, saad iqbal advanced file manager +1 more +3 moreMultiple elFinder Plugins - Authenticated OS Command InjectionCVE-2026-63829.1 Critical
- bowo admin and site enhancements (ase), unknown admin-site-enhancements-pro +1 moreAdmin and Site Enhancements < 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for ParameterCVE-2026-120838.1 High
- unknown fileorganizerFileOrganizer < 1.2.0 - Authenticated Arbitrary File Upload via elFinder File OperationsCVE-2026-119628.8 High
- unknown simple membershipSimple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API VersionCVE-2026-118558.8 High
- ultimate member member, unknown ultimate member +1 moreUltimate Member < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile FieldsCVE-2026-117668.0 High
- unknown allcoachAllCoach < 1.0.2 - Unauthenticated Account TakeoverCVE-2026-108308.8 High
- unknown notifications for forms & wordpress actionsWANotifier < 2.6 - Subscriber+ LFICVE-2024-62287.5 High
- professionalwiki mapsmediawiki/maps: Stored XSS through the overlays parameter in the display_map parser functionCVE-2026-52854Fix available8.6 High
- andrew fiebert simple urlsWordPress Simple URLs plugin <= 151 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-577625.9 Medium
- andy fragen wp debuggingWordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-573507.1 High
- rustaurius five star business profile and schemaWordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerabilityCVE-2026-274369.1 Critical
- dylan ngo woostify sites libraryWordPress Woostify Sites Library plugin <= 1.6.2 - Broken Access Control vulnerabilityCVE-2025-660765.3 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.0 - Unauthenticated Paid Membership BypassCVE-2026-119656.5 Medium
- unknown adminifyAdminify < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAXCVE-2026-117812.7 Low
- unknown fluent formsFluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDORCVE-2026-115782.7 Low
- unknown yoothemeYOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data AttributesCVE-2026-100776.8 Medium
- figureone insert pagesInsert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)CVE-2026-100896.4 Medium
- unknown applyonlineWordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerabilityCVE-2026-577215.3 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.30.20 - Subscriber+ Booking Approval BypassCVE-2026-118874.3 Medium
- unknown webauthn provider for two factorWebAuthn Provider for Two Factor < 2.5.6 - 2FA BypassCVE-2026-118837.2 High
- unknown fluent formsFluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDORCVE-2026-118803.1 Low
- unknown advanced form integration — connect forms to 200+ appsAdvanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role MappingCVE-2026-117948.1 High
- jeff starr user submitted postsUser Submitted Posts < 20260608 - Unauthenticated Stored XSS via Author NameCVE-2026-115704.2 Medium
- mklacroix product configurator for woocommerceProduct Configurator for WooCommerce < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_dataCVE-2026-115687.5 High
- unknown ws form lite, ws form lite +1 moreWS Form LITE < 1.11.8 - Subscriber+ Arbitrary Settings UpdateCVE-2026-115624.3 Medium
- royal plugins mcp, unknown royal mcp +1 moreRoyal MCP < 1.4.26 - Subscriber+ Insufficient Authorization in MCP ToolsCVE-2026-107508.1 High
- shahjahan jewel fluent bookingFluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee ExportCVE-2026-95764.9 Medium
- unknown wp support plus responsive ticket systemWP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array KeysCVE-2026-115908.6 High
- unknown wp support plus responsive ticket systemWP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored XSS via File UploadCVE-2026-115898.8 High
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field CaptionCVE-2026-115815.9 Medium
- spencer haws link whisper freeWordPress Link Whisper Free plugin <= 0.9.4 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2026-573337.1 High
- faktor vier f4 post treef4 Post Tree < 2.0.5 - Subscriber+ Arbitrary Post Parent/Menu Order ModificationCVE-2026-96764.3 Medium
- unknown apcu managerAPCu Manager < 4.5.0 - Unauthenticated Stored XSS via Cache Key PollutionCVE-2026-100837.5 High
- nmedia frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File DeletionCVE-2026-80958.1 High
- unknown shariff for wordpressShariff for WordPress <= 1.0.11 - Admin+ Stored Cross-Site ScriptingCVE-2026-96774.8 Medium
- unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict contentProfilePress < 4.16.17 - Subscriber+ Subscription Cancellation via IDORCVE-2026-108208.1 High
- ays pro popup boxWordPress Popup box plugin <= 6.0.1 - SQL Injection vulnerabilityCVE-2026-576317.6 High
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerabilityCVE-2026-573186.5 Medium
- chrisvrichardson mappress maps for wordpressWordPress MapPress Maps for WordPress plugin <= 2.97.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-56011Public exploit7.1 High
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post DeletionCVE-2026-8380Public exploit6.5 Medium
- salesmanago & leadoo, unknown salesmanago & leadoo +1 moreSALESmanago & Leadoo < 3.11.3 - Subscriber+ SQL InjectionCVE-2026-108357.7 High
- unknown ymc filterYMC Smart Filter < 3.11.3 - Unauthenticated Private/Draft Post DisclosureCVE-2026-108237.5 High
- printcart web to print product designer for woocommerce, unknown printcart web to print product designer for woocommerce +1 morePrintcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Unauthenticated Folder Content Disclosure via Path TraversalCVE-2025-102685.3 Medium
- inspirelabs inpost plInPost PL < 1.9.1 - Unauthenticated WooCommerce Order Parcel-Locker HijackingCVE-2026-97027.5 High
- Show moreLoading…