Skip to contentUnknown vulnerabilities
Newest
- unknown theme demo importTheme Demo Import <= 1.1.3 - Admin+ Arbitrary File UploadCVE-2026-13157Public exploit7.2 High
- tomdever wpforo forumwpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location FieldCVE-2026-126965.4 Medium
- unknown builderall for wordpressBuilderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST RoutesCVE-2026-118823.7 Low
- unknown spectra legacySpectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block AttributesCVE-2026-108273.5 Low
- unknown admin columns for acf fieldsAdmin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value ColumnCVE-2026-152625.4 Medium
- unknown codeless page builderCodeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode AttributeCVE-2026-152345.4 Medium
- unknown everest toolkitEverest Toolkit <= 1.2.3 - Admin+ Arbitrary File UploadCVE-2026-13158Public exploit7.2 High
- unknown user profile builderProfile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After RegistrationCVE-2026-153688.1 High
- realmag777 huskyHUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_viewCVE-2026-152447.2 High
- unknown login & register formsLogin/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit BypassCVE-2026-148368.1 High
- unknown dynamickit for elementorDynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Link Host InjectionCVE-2026-145968.8 High
- unknown chat on desk order notificationsChat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP BypassCVE-2026-143098.1 High
- shahjahan jewel fluent supportFluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDORCVE-2026-141973.8 Low
- unknown direct payments for woocommerceDirect Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX ActionsCVE-2026-129665.3 Medium
- unknown bit formBit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress LabelCVE-2025-156694.8 Medium
- palscode support genixSupport Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path TraversalCVE-2026-159325.3 Medium
- unknown shopmonitor.ioShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email RerouteCVE-2026-149199.8 Critical
- palscode support genixSupport Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing AuthorizationCVE-2026-148623.7 Low
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form FieldCVE-2026-136098.8 High
- unknown elementskit elementor addonsElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)CVE-2026-133933.5 Low
- tomdever wpforo forumwpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDORCVE-2026-126975.4 Medium
- unknown miniorange 2faminiOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secretCVE-2026-126958.1 High
- kodezen llc academy lmsAcademy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST EndpointCVE-2026-123764.3 Medium
- unknown buddypressBuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDORCVE-2026-81555.4 Medium
- unknown elementskit elementor addonsElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)CVE-2026-133927.2 High
- themeum kirkiKirki < 6.0.13 - Unauthenticated SQL InjectionCVE-2026-127218.6 High
- themeum kirkiKirki < 6.0.13 - Unauthenticated PHP Object InjectionCVE-2026-127207.5 High
- ultimate member member, unknown ultimate member +1 moreUltimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection FieldCVE-2026-122518.1 High
- unknown wp go maps, wp go maps (formerly wp google maps) go maps +1 moreWP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filterCVE-2026-153813.7 Low
- unknown product feed manager for woocommerceProduct Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed FilterCVE-2026-152588.1 High
- joomsky js help deskJS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDORCVE-2026-152096.5 Medium
- unknown geeky botGeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat HistoryCVE-2026-150487.5 High
- joomsky js help deskJS Help Desk < 3.1.4 - Contributor+ User Email DisclosureCVE-2026-149316.5 Medium
- joomsky js help deskJS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment UploadCVE-2026-149307.5 High
- joomsky js help deskJS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDORCVE-2026-149294.3 Medium
- joomsky js help deskJS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubjectCVE-2026-149286.5 Medium
- unknown fluentcart a new era of ecommerceFluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print RoutesCVE-2026-149273.7 Low
- opajaap wp photo album plusWP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo CommentCVE-2026-149226.1 Medium
- brainstorm force ultimate addons for wpbakery page builderUltimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons ShortcodeCVE-2026-149216.1 Medium
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export FilesCVE-2026-148493.7 Low
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDORCVE-2026-148474.3 Medium
- ice00 newstatpressNewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post WidgetCVE-2026-148456.1 Medium
- unknown events made easyEvents Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDORCVE-2026-148435.3 Medium
- unknown mailgun for wordpressMailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAXCVE-2026-148346.5 Medium
- unknown lightbox with photoswipeLightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption AttributeCVE-2026-148336.8 Medium
- unknown flxwooFlxWoo < 3.1.1 - Unauthenticated Payment BypassCVE-2026-148307.5 High
- unknown check & log emailCheck & Log Email < 2.0.15 - Admin+ SQL Injection via d and s ParametersCVE-2026-145546.5 Medium
- unknown demiDemi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup DirectoryCVE-2026-143337.5 High
- stellarwp givewpGiveWP < 4.16.3 - Unauthenticated Recurring Donor Information DisclosureCVE-2026-143197.5 High
- stellarwp givewpGiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction BypassCVE-2026-143175.3 Medium
- Show moreLoading…