Skip to contentUnknown vulnerabilities
Newest
- carazo import and export users and customersImport and export users and customers < 2.4.3 - Admin+ Arbitrary File ReadCVE-2025-156734.9 Medium
- unknown chamawpChama < 1.0.13 - Unauthenticated PHP Object InjectionCVE-2025-156728.1 High
- carazo import and export users and customersImport and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV ImportCVE-2026-165349.1 Critical
- unknown link libraryLink Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission FormCVE-2026-165329.1 Critical
- radiustheme classified listingClassified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_searchCVE-2026-162762.7 Low
- radiustheme classified listingClassified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_postsCVE-2026-162742.7 Low
- unknown contest galleryContest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_libraryCVE-2026-160576.5 Medium
- nsquared simply schedule appointmentsSimply Schedule Appointments < 1.6.12.11 - Contributor+ Sensitive Data Disclosure via Admin ShortcodeCVE-2026-152546.5 Medium
- unknown gallery for google photosGallery for Google Photos < 1.2.1 - Unauthenticated Google OAuth Token DisclosureCVE-2026-152367.5 High
- nsquared simply schedule appointmentsSimply Schedule Appointments < 1.6.12.6 - Unauthenticated Appointment Data Disclosure and Mass Deletion via purge EndpointCVE-2026-16540Public exploit7.5 High
- unknown webtoffee-cookie-consentWebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST RoutesCVE-2026-133896.5 Medium
- syed balkhi charitableCharitable < 1.8.5.3 - Admin+ Stored XSS via Photo Field ALT TextCVE-2025-156754.8 Medium
- unknown frontend file manager pluginFrontend File Manager Plugin <= 23.6 - File Metadata Update via CSRFCVE-2026-162925.4 Medium
- metagauss profilegridProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDORCVE-2026-162914.3 Medium
- thedotstore product attachment for woocommerceWooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media DownloadCVE-2026-162857.5 High
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_eventCVE-2026-160645.4 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline ContentCVE-2026-160635.4 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ ContentCVE-2026-160626.6 Medium
- unknown narrative publisherNarrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post MetaCVE-2026-162734.6 Medium
- unknown login-socialHuge IT Login <= 1.0.4 - Unauthenticated Account TakeoverCVE-2026-162617.5 High
- lws optimize, unknown lws optimize +1 moreLWS Optimize < 3.4 - Subscriber+ Cache DeletionCVE-2026-160424.3 Medium
- unknown pouco import usersPouco Import Users <= 1.0.0 - Unauthenticated Privilege EscalationCVE-2026-162569.8 Critical
- unknown simple restrictSimple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST APICVE-2026-159392.7 Low
- unknown rt mega menuRT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSSCVE-2026-153855.4 Medium
- bdthemes element pack addons for elementorElement Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data AttributesCVE-2026-148176.8 Medium
- unknown lenxel wpLenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password ResetCVE-2026-125868.1 High
- unknown clever mega menu for visual composerClever Mega Menu for Visual Composer <= 1.0.1 - Subscriber+ Menu Item Meta Update via save_clever_menu_itemCVE-2026-118724.3 Medium
- metabox meta boxMeta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDORCVE-2026-152485.5 Medium
- unknown ai chatbot for woocommerceChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_responseCVE-2026-152417.5 High
- unknown sms alertSMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-MobileCVE-2026-152067.5 High
- rustaurius five star restaurant reservationsFive Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notificationsCVE-2026-151517.5 High
- mahmudul hasan arif fluentboardsFluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDORCVE-2026-149384.3 Medium
- acymailing newsletter team acymailingAcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] ParameterCVE-2026-149208.2 High
- crocoblock jetengineJetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine ShortcodeCVE-2026-148645.4 Medium
- kingaddons.com king addons for elementorKing Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid WidgetCVE-2026-148416.1 Medium
- gm alex user access managerUser Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' ParameterCVE-2026-183527.5 High
- unknown yop poll, yop poll +1 moreYOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header SpoofingCVE-2026-14840Public exploit5.3 Medium
- mapster wp maps, unknown mapster wp maps +1 moreMapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content DisclosureCVE-2026-148397.5 High
- theeventscalendar event tickets and registrationEvent Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDORCVE-2026-148232.2 Low
- theeventscalendar event tickets and registrationEvent Tickets < 5.29.0.1 - Unauthenticated PayPal Order Status ManipulationCVE-2026-148225.3 Medium
- unknown authora : easy login with mobile numberAuthora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP DisclosureCVE-2026-145616.5 Medium
- unknown pixel tag manager for woocommercePixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event SubmissionCVE-2026-143156.5 Medium
- codename065 download managerWordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package TitleCVE-2026-142925.4 Medium
- unknown booking for appointments and events calendarAmelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass AssignmentCVE-2026-142142.7 Low
- themefusecom brizyBrizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_infoCVE-2026-141952.7 Low
- eric teubert podlove podcast publisherPodlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRFCVE-2026-137294.3 Medium
- acowebs dynamic pricing with discount rules for woocommerceDynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjaxCVE-2026-137257.1 High
- unknown pixelavoPixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAXCVE-2026-136045.3 Medium
- unknown participants databaseParticipants Database < 2.7.8.4 - Unauthenticated SQL Injection via List SearchCVE-2026-135969.1 Critical
- unknown buckaroo woocommerce payments pluginWC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order RefundCVE-2026-133296.5 Medium
- Show moreLoading…