Skip to contentUnknown vulnerabilities
Newest
- realtyna organic idx plugin + wpl real estate, unknown realtyna organic idx plugin + wpl real estate +1 moreRealtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File UploadCVE-2026-162368.8 High
- realtyna organic idx plugin + wpl real estate, unknown realtyna organic idx plugin + wpl real estate +1 moreRealtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' CommandCVE-2026-14483Public exploit9.8 Critical
- themeum tutor lmsTutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply InjectionCVE-2026-143105.4 Medium
- unknown wp delicious, wp delicious delicious +1 moreWP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likesCVE-2026-143055.3 Medium
- goodlayers tourmasterTourmaster < 5.4.8 - Stored XSS via CSRFCVE-2026-142397.1 High
- unknown online scheduling and appointment booking systemBookly < 27.8 - Unauthenticated SQL Injection via staff_idCVE-2026-133958.6 High
- unknown essential addons for elementorEssential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare TableCVE-2026-133455.3 Medium
- unknown essential addons for elementorEssential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title TagCVE-2026-133444.8 Medium
- unknown animation addons for elementorAnimation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG UploadCVE-2026-133306.1 Medium
- arraytics eventinEventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status ManipulationCVE-2026-131787.5 High
- unknown wp travel, wp travel travel +1 moreWP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDORCVE-2026-131454.3 Medium
- unknown wp travel, wp travel travel +1 moreWP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPNCVE-2026-131435.3 Medium
- unknown wp travel engine, wp travel engine travel engine +1 moreWP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option UpdateCVE-2026-125007.5 High
- unknown fluent formsFluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time FieldCVE-2026-118816.1 Medium
- unknown wp ghost (hide my wp ghost)Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism BypassCVE-2026-118705.4 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing AuthorizationCVE-2026-118676.5 Medium
- brainstorm force ultimate addons for wpbakery page builderUltimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fontsCVE-2026-153826.5 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile ModificationCVE-2026-152575.3 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDORCVE-2026-152555.3 Medium
- search atlas seo, unknown search atlas seo +1 moreSearch Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API AccessCVE-2026-152525.4 Medium
- unknown points and rewards for woocommercePoints and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDORCVE-2026-117825.9 Medium
- unknown appointment booking pluginLatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking FunnelCVE-2026-152505.3 Medium
- unknown customer switchingCustomer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator ResolutionCVE-2026-152407.5 High
- stellarwp givewpGiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template SettingsCVE-2026-143186.8 Medium
- unknown lifterlmsLifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_postsCVE-2026-142314.3 Medium
- unknown lifterlmsLifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing InformationCVE-2026-142076.1 Medium
- jetmonsters motopress hotel bookingHotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX ActionCVE-2026-152354.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List SearchCVE-2026-151536.8 Medium
- unknown bit formBit Form < 3.1.2 - Unauthenticated Inactive Form SubmissionCVE-2026-150543.7 Low
- metagauss profilegridProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group IDCVE-2026-126877.5 High
- kp4coder sync post with other siteSync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/ModificationCVE-2026-149236.5 Medium
- unknown remote apiRemote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query ParameterCVE-2026-146029.0 Critical
- unknown wp real ip-based access controlWP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addrCVE-2026-145926.1 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments ListingCVE-2026-142264.3 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDORCVE-2026-142234.3 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing AuthorizationCVE-2026-142223.8 Low
- easyappointments easy appointmentsEasy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing AuthorizationCVE-2026-142213.8 Low
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Contributor+ Customer Data DisclosureCVE-2026-141882.7 Low
- cyberlord92 miniorange social login and register (discord, google, twitter, linkedin)miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account TakeoverCVE-2026-143008.1 High
- realmag777 wolfWOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRFCVE-2026-142347.1 High
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDORCVE-2026-142245.4 Medium
- payuplugin payu commercepro pluginPayU CommercePro < 3.9.0 - Unauthenticated Order TamperingCVE-2026-136925.3 Medium
- stiofan userswpUsersWP < 1.2.67 - Two-Factor Authentication BypassCVE-2026-136907.4 High
- unknown photoswipePhoto Swipe <= 4.1.1.1 - Author+ Stored XSS via title AttributeCVE-2026-136056.8 Medium
- iqonicdesign streamitStreamit < 4.5.2 - Unauthenticated Remote Code Execution via Arbitrary Function CallCVE-2026-134239.8 Critical
- unknown wp-media-folder-addonMedia folder Addon < 4.1.7 - Unauthenticated Arbitrary File DownloadCVE-2026-119748.6 High
- unknown shinystat analyticsShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information DisclosureCVE-2026-113515.3 Medium
- foomagoo plugin organizerPlugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL InjectionCVE-2026-153046.5 Medium
- unknown fluentcart a new era of ecommerceFluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDORCVE-2026-149264.2 Medium
- unknown tablesome tableTablesome < 1.1.31 - Unauthenticated Post Creation and ModificationCVE-2026-149247.5 High
- Show moreLoading…