Skip to contentUnknown vulnerabilities
Newest
- complianzWordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerabilityCVE-2026-654964.4 Medium
- motov.net ebook storeWordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerabilityCVE-2026-654535.3 Medium
- motov.net ebook storeWordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerabilityCVE-2026-654525.3 Medium
- pi web solution product enquiry for woocommerceWordPress Product Enquiry for WooCommerce plugin <= 2.2.34.43 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-595127.1 High
- storeapps smart managerWordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-577047.1 High
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerabilityCVE-2026-273726.5 Medium
- roundupwp registrations for the events calendar – event registration pluginRegistrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' ParameterCVE-2026-131196.5 Medium
- unknown post status notifier litePost Status Notifier Lite < 1.13.0 - Reflected XSS via mod ParameterCVE-2026-95774.8 Medium
- aresit wp compressWP Compress < 7.10.04 - Reflected XSS via test_zoneCVE-2026-90666.1 Medium
- unknown security-ninja-premiumSecurity Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2faCVE-2026-142917.5 High
- unknown praison ai seoPraison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)CVE-2026-120827.5 High
- formcraftFormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-ParametersCVE-2026-72327.2 High
- arraytics timeticsTimetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_methodCVE-2026-143225.3 Medium
- pixelite events managerEvents Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking RegistrationCVE-2026-129877.5 High
- unknown product addons and product options with custom fieldsProduct Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG UploadCVE-2026-129688.8 High
- saturday drive ninja formsNinja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio FieldsCVE-2026-650528.7 High
- saturday drive ninja formsNinja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission HandlerCVE-2026-650516.9 Medium
- saturday drive ninja formsNinja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated VisitorsCVE-2026-650507.1 High
- saturday drive ninja formsNinja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX ActionCVE-2026-650498.4 High
- saturday drive ninja formsNinja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission IndexCVE-2026-650489.3 Critical
- unknown bpost-shipping-platformBpost Shipping Platform < 3.2.3 - Unauthenticated SQL InjectionCVE-2026-80827.5 High
- unknown wpbotWPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings UpdateCVE-2026-141854.3 Medium
- kodezen llc academy lmsAcademy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDORCVE-2026-141845.4 Medium
- radiustheme classified listingClassified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDORCVE-2026-141834.3 Medium
- unknown bit formBit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication BypassCVE-2026-136946.5 Medium
- unknown bit formBit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path TraversalCVE-2026-136935.9 Medium
- unknown free theme builder for elementorCRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact FormCVE-2026-117678.8 High
- stevejburge tag groups is the advanced way to display your taxonomy termsTag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' ParameterCVE-2026-9833Public exploit7.1 High
- elementor website builder, unknown elementor website builder +1 moreElementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST APICVE-2026-88254.9 Medium
- codexpert inc thumbpressThumbPress < 6.2.2 - Subscriber+ Plugin DeactivationCVE-2026-134325.4 Medium
- unknown mailersendMailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRFCVE-2026-13156Public exploit5.4 Medium
- themeum kirkiKirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apisCVE-2026-131479.1 Critical
- unknown social login, passkeys, magic link & email otpPasswordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute ForceCVE-2026-131428.1 High
- unknown payplus payment gatewayPayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status ModificationCVE-2026-129736.5 Medium
- unknown payplus payment gatewayPayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata TamperingCVE-2026-129725.3 Medium
- thimpress learnpressLearnPress < 4.4.1 - Reflected XSS via c_searchCVE-2026-129707.1 High
- servmask all-in-one wp migration and backupAll-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path TraversalCVE-2026-128986.5 Medium
- themeum kirkiKirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-passwordCVE-2026-127244.3 Medium
- themeum kirkiKirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component LibraryCVE-2026-127235.3 Medium
- unknown slimstat analyticsSlimStat Analytics < 5.5.0 - Unauthenticated Stored XSS via CF-IPCountry HeaderCVE-2026-125927.5 High
- unknown wp travel, wp travel travel +1 moreWP Travel < 11.7.1 - Unauthenticated Arbitrary Booking CancellationCVE-2026-118685.3 Medium
- unknown modern event calendar pro, modern events calendar lite +1 moreModern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_moreCVE-2026-11349Public exploit8.6 High
- unknown all in one seoAll in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI IntegrationCVE-2026-107552.7 Low
- unknown reviews feedReviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google ReviewsCVE-2026-107244.8 Medium
- unitecms unlimited elements for elementorUnlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews WidgetCVE-2026-100818.8 High
- quadlayers ai copilotAI Chatbot & Workflow Automation by AIWU < 1.5.4 - Unauthenticated Privilege Escalation via MCP OAuthCVE-2026-98109.8 Critical
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template DisclosureCVE-2026-134025.3 Medium
- unknown wps bookings for woocommerceWPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Order Cancellation via IDORCVE-2026-123935.4 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription HandlerCVE-2026-119665.3 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership IDCVE-2026-119618.1 High
- Show moreLoading…