Skip to contentUnknown vulnerabilities
Newest
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_idCVE-2026-148707.1 High
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template DeletionCVE-2026-148212.7 Low
- theeventscalendar event tickets and registrationEvent Tickets < 5.28.4 - Editor+ Stored XSS via Ticket MoveCVE-2026-148193.5 Low
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password ResetCVE-2026-145459.8 Critical
- nasirahmed advanced form integration — connect forms to 200+ appsAdvanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() FunctionCVE-2026-165874.3 Medium
- isaumya ad invalid click protector (aicp)WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerabilityCVE-2026-654456.5 Medium
- unknown backwpupWordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-654437.1 High
- subtle web inc formcraftWordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerabilityCVE-2026-654427.2 High
- cleantalk inc spam protection, antispam, firewall by cleantalkWordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-654377.1 High
- shapedplugin llc location weatherWordPress Location Weather plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-664336.5 Medium
- chrisvrichardson mappress maps for wordpressWordPress MapPress Maps for WordPress plugin <= 2.97.6 - Sensitive Data Exposure vulnerabilityCVE-2026-655645.3 Medium
- franky events made easyWordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerabilityCVE-2026-595576.5 Medium
- motov.net ebook storeWordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerabilityCVE-2026-595297.5 High
- unknown bookingpress-appointment-booking-proBookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback BugCVE-2026-9830Public exploit8.2 High
- humhub calendarCalendar < 1.3.18 - Contributor+ Stored XSS via event_link ParameterCVE-2026-148276.8 Medium
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.1.3 - Unauthenticated User Enumeration and Password Oracle via Quiz LoginCVE-2026-148205.3 Medium
- unknown user frontend: ai powered frontend post submission, user directory, user profile, membership & user registrationWP User Frontend < 4.3.8 - Unauthenticated Author-less Attachment DeletionCVE-2026-145686.5 Medium
- unknown facturaone para woocommerce con verifactuWP FacturaONE < 5.37 - Unauthenticated Remote Code ExecutionCVE-2026-142899.0 Critical
- takayukister contact form 7Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open RedirectCVE-2026-142364.7 Medium
- codename065 download managerWordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download KeyCVE-2026-142357.5 High
- unknown smart managerSmart Manager < 8.92.0 - Contributor+ Stored XSS via Post TitleCVE-2026-142034.8 Medium
- shaonsina sina extension for elementorSina Extension for Elementor < 3.10.2 - Reflected XSSCVE-2026-141906.1 Medium
- unknown wpbotWPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fieldsCVE-2026-141893.8 Low
- themeisle mpgMultiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcodeCVE-2026-137267.1 High
- unknown realtyna organic idx plugin + wpl real estateRealtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code ExecutionCVE-2026-13714Public exploit9.8 Critical
- unknown 微信二维码登陆QRcode Login for WeChat <= 1.3 - Unauthenticated Account TakeoverCVE-2026-135979.1 Critical
- nsquared simply schedule appointmentsSimply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer InformationCVE-2026-134006.1 Medium
- stellarwp the events calendarThe Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status ManipulationCVE-2026-133905.3 Medium
- unknown masteriyo lmsMasteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)CVE-2026-133329.1 Critical
- silverplugins217 custom fields account registration for woocommerceCustom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege EscalationCVE-2026-13152Public exploit8.1 High
- dan rossiter document galleryDocument Gallery < 5.1.1 - Reflected XSS via dg_generate_galleryCVE-2026-129826.1 Medium
- elbanyaoui clover payment gateway by zaytech for woocommerceClover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_orderCVE-2026-124937.5 High
- unknown memberglutMemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to AdministratorCVE-2026-123949.8 Critical
- mainwp child, unknown mainwp child +1 moreMainWP Child < 6.1.2 - Unauthenticated Administrator Authentication Bypass via Passwordless Site RegistrationCVE-2026-122558.1 High
- monetizemore advanced adsAdvanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' ParameterCVE-2026-100826.1 Medium
- printcart web to print product designer for woocommerce, unknown printcart web to print product designer for woocommerce +1 morePrintcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request ForgeryCVE-2025-156628.6 High
- unknown wowoptin: next-gen popup makerWowOptin < 1.4.38 - Unauthenticated Opt-in Deactivation and Template Row InjectionCVE-2026-146037.5 High
- unknown cafehaus apiCAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password ResetCVE-2026-129817.5 High
- unknown project management, bug and issue tracking pluginSoftware Issue Manager < 5.1.0 - Unauthenticated SQL Injection via Search ParameterCVE-2026-128779.1 Critical
- metagauss profilegridProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing AuthorizationCVE-2026-126903.8 Low
- metagauss profilegridProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing AuthorizationCVE-2026-126895.4 Medium
- metagauss profilegridProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN ForgeryCVE-2026-126886.5 Medium
- unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict contentProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role SelectionCVE-2026-124977.5 High
- mailpoetWordPress MailPoet plugin 5.30.0-5.33.0 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-576267.1 High
- bimal rekhadiya kwayy html sitemapWordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerabilityCVE-2026-655397.1 High
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerabilityCVE-2026-655167.2 High
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-655107.1 High
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerabilityCVE-2026-654996.5 Medium
- complianzWordPress Complianz plugin <= 7.5.0 - Sensitive Data Exposure vulnerabilityCVE-2026-654985.3 Medium
- complianzWordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerabilityCVE-2026-654977.2 High
- Show moreLoading…