Skip to contentUnknown vulnerabilities
Newest
- phonepe payment solutions, unknown phonepe payment solutions +1 morePhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged CallbackCVE-2026-115757.5 High
- basix nex-formsNEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form SubmissionCVE-2026-105256.1 Medium
- unitedover digits: wordpress mobile number signup and loginDigits: WordPress Mobile Number Signup and Login <= 9.1.0.5 - Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' ParameterCVE-2026-137418.8 High
- unknown funnelkitFunnelKit < 3.15.0.6 - Admin+ Arbitrary File Deletion via Path Traversal in Template ImporterCVE-2026-129795.5 Medium
- unknown funnelkitFunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin FormCVE-2026-129787.1 High
- rometheme rtmkitRTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and ActivationCVE-2026-129072.7 Low
- rometheme rtmkitRTMKit Addons for Elementor < 2.0.9 - Contributor+ Private Post Title DisclosureCVE-2026-129062.7 Low
- unknown header footer builder for elementorHeader Footer Builder for Elementor < 1.2.1 - Contributor+ Stored XSS via Template ImportCVE-2026-128696.1 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_mediaCVE-2026-12684Public exploit6.5 Medium
- tyche softwares abandoned cart lite for woocommerceAbandoned Cart Lite for WooCommerce < 6.8.2 - Unauthenticated Account Takeover via Malleable Recovery-Link TokenCVE-2026-125858.1 High
- davidanderson redux frameworkRedux Framework < 4.5.13 - Subscriber+ Privilege Escalation to AdministratorCVE-2026-125258.8 High
- jordy meow ai engineAI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDORCVE-2026-125105.9 Medium
- unknown happy coders otp login for woocommerceHappy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_userCVE-2026-124929.8 Critical
- unknown wp job portalWP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' ParameterCVE-2026-123956.5 Medium
- unknown appointment booking pluginLatePoint < 5.6.3 - Multiple Privileged Actions via CSRFCVE-2026-118665.4 Medium
- unknown betterdocsBetterDocs < 4.5.5 - Unauthenticated Stored XSS via AI Doc Summarizer Prompt InjectionCVE-2026-113716.1 Medium
- oooorgle quotes llamaQuotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc ParameterCVE-2026-125128.6 High
- unknown shibbolethShibboleth < 2.5.4 - Unauthenticated Administrator Account Creation via Identity Header SpoofingCVE-2026-122818.1 High
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDORCVE-2026-115805.5 Medium
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.17 - Unauthenticated Media UploadCVE-2026-115795.3 Medium
- unknown wp 2faWP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email BindingCVE-2026-129886.4 Medium
- tribulant software newslettersNewsletters < 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom FieldCVE-2026-125838.1 High
- jordy meow ai engineAI Engine < 3.5.5 - Editor+ Arbitrary File Write via Path TraversalCVE-2026-125118.1 High
- unknown sureformsSureForms < 2.11.1 - Unauthenticated Payment Amount BypassCVE-2026-115675.9 Medium
- unknown word count and social sharesWord Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path TraversalCVE-2026-115639.6 Critical
- unknown ultimate before after image slider & galleryBEAF < 4.7.1 - Admin+ Stored XSS via Widget Shortcode FieldCVE-2025-156655.4 Medium
- unknown wpzoom portfolio, wpzoom portfolio +1 moreWordPress WPZOOM Portfolio plugin <= 1.4.29 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-577127.1 High
- crm perks contact form entriesWordPress Contact Form Entries plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-577087.1 High
- owthub library management systemLibrary Management System < 3.5.8 - Unauthenticated SQL Injection via book_idCVE-2026-125828.6 High
- unknown wp job portalWP Job Portal < 2.5.5 - Subscriber+ Employer Email Disclosure via IDORCVE-2026-123974.3 Medium
- unknown wp job portalWP Job Portal < 2.5.5 - Subscriber+ Arbitrary Job Approval, Featuring and RejectionCVE-2026-123965.4 Medium
- themeum tutor lmsTutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki IntegrationCVE-2026-122757.1 High
- themeum tutor lmsTutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDORCVE-2026-122746.5 Medium
- themeum tutor lmsTutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment CreationCVE-2026-122734.3 Medium
- themeum tutor lmsTutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDORCVE-2026-122715.4 Medium
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File FieldCVE-2026-120815.0 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.2 - Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership ActivationCVE-2026-119649.1 Critical
- unknown user registration & membershipUser Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDORCVE-2026-119638.1 High
- cloudways breeze cacheBreeze Cache < 2.5.6 - Unauthenticated Stored XSS via Minify LibraryCVE-2026-105516.1 Medium
- catalyst2020 catalyst connect zoho crm client portalCatalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid ParameterCVE-2025-50174.9 Medium
- unknown white label cmsWhite Label CMS <= 2.7.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import SettingsCVE-2026-118984.4 Medium
- unknown escortwpEscortWP <= 3.6.2 - Content Deletion via Vendor-Authored BackdoorCVE-2026-126857.5 High
- la-studio element kit for elementor, unknown la-studio element kit for elementor +1 moreLA-Studio Element Kit for Elementor < 1.6.1 - Unauthenticated Open RegistrationCVE-2026-122765.3 Medium
- ninjew geo my wpGEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' ParametersCVE-2026-153009.1 Critical
- stefanbohacek fediverse embedsFediverse Embeds < 1.5.8 - Unauthenticated SSRF via Site Info EndpointCVE-2026-125175.3 Medium
- stefanbohacek fediverse embedsFediverse Embeds < 1.5.8 - Unauthenticated SSRF via Media ProxyCVE-2026-125165.3 Medium
- unknown everest formsEverest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST EndpointsCVE-2026-122706.5 Medium
- unknown wp support plus responsive ticket systemWP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie ForgeryCVE-2026-118755.3 Medium
- legalweb wp dsgvo tools (gdpr)WP DSGVO Tools (GDPR) < 3.1.40 - Unauthenticated Sensitive Information Disclosure via Subject Access RequestCVE-2026-118695.3 Medium
- unknown everest formsEverest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV ArtifactsCVE-2026-115717.5 High
- Show moreLoading…