Skip to contentUnknown vulnerabilities
Newest
- multivendorxMultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing AuthorizationCVE-2026-166057.2 High
- unknown passsterContent Protector (Passster) < 4.3.6 - Unauthenticated Protected Content Disclosure via Content-Lock Block data-content AttributeCVE-2026-166047.5 High
- unknown passsterContent Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST APICVE-2026-166037.5 High
- unknown passsterContent Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST EndpointCVE-2026-166027.5 High
- unknown orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & moreOrbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG UploadCVE-2026-165836.1 Medium
- unknown bit formBit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature UploadCVE-2026-165737.5 High
- sunshinephotocart sunshine photo cartSunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment DisclosureCVE-2026-165617.5 High
- unknown chat widget: floating customer support button for 30+ channels, supporting sms, calls, and chatBit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response EndpointCVE-2026-165486.5 Medium
- unknown rest api logREST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download EndpointCVE-2026-165475.9 Medium
- unknown wired impact volunteer management, wired impact volunteer management +1 moreWired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvpCVE-2026-165464.3 Medium
- creative motion clearfy cacheClearfy < 2.4.3 - Open Redirect via Cyrlitera 404 HandlerCVE-2026-162964.7 Medium
- creative motion clearfy cacheClearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action DispatcherCVE-2026-162954.3 Medium
- blubrry powerpress podcasting plugin by blubrryBlubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URLCVE-2026-162936.8 Medium
- themefusecom brizyBrizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDORCVE-2026-160702.7 Low
- themefusecom brizyBrizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal PointCVE-2026-160696.8 Medium
- themefusecom brizyBrizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code AssetCVE-2026-160683.5 Low
- unknown contest galleryContest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_promptsCVE-2026-160564.3 Medium
- unknown miniorange 2faminiOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP SendCVE-2026-160354.3 Medium
- unknown easy integration for dropboxEasy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAXCVE-2026-159589.3 Critical
- unknown nested pagesNested Pages < 3.2.15 - Editor+ Stored XSS via Post TitleCVE-2026-152334.8 Medium
- themeisle visualizerVisualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON ImportCVE-2026-149396.8 Medium
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id ParameterCVE-2026-148726.8 Medium
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkoutCVE-2026-148485.4 Medium
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar QuestionCVE-2026-148244.8 Medium
- unknown the gdpr framework by data443The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests SpamCVE-2026-148166.5 Medium
- tomdever wpforo forumwpForo Forum < 3.1.3 - Subscriber+ Account Status and Reputation Manipulation via Profile Update Mass AssignmentCVE-2026-126984.3 Medium
- unknown monsterinsightsMonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC BypassCVE-2026-113663.7 Low
- unknown embedpressEmbedPress < 4.6.1 - Unauthenticated Blind SSRFCVE-2026-105265.8 Medium
- unknown create block themeCreate Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)CVE-2026-166238.0 High
- unknown improve seoImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code ExecutionCVE-2026-166189.8 Critical
- unknown simple google calendar outlook events widgetSimple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_idCVE-2026-165365.3 Medium
- unknown logmytripLogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' CookieCVE-2026-165728.6 High
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST APICVE-2026-165654.3 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST EndpointCVE-2026-165644.3 Medium
- kodezen llc academy lmsAcademy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST EndpointCVE-2026-165636.5 Medium
- unknown sm page duplicatorSM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page DuplicationCVE-2026-165398.1 High
- unknown chamawpChama < 1.0.13 - Unauthenticated Arbitrary User Password ResetCVE-2026-163009.8 Critical
- creative motion clearfy cacheClearfy < 2.4.3 - Admin+ PHP Object Injection via Settings ImportCVE-2026-162974.1 Medium
- metagauss profilegridProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_groupCVE-2026-162894.3 Medium
- unknown personal qr messagePersonal QR Message <= 1.0 - Unauthenticated Arbitrary File UploadCVE-2026-162509.8 Critical
- brian batt - elearningfreak.com insert or embed articulate content into wordpressInsert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File UploadCVE-2026-160609.8 Critical
- unknown simple membershipSimple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber NameCVE-2026-159316.1 Medium
- unknown simple membershipSimple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username CollisionCVE-2026-159309.4 Critical
- meril inc. blog floating buttonBlog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent HeaderCVE-2026-153836.1 Medium
- unknown geo my wpGeo My WP < 4.5.5.3 - Subscriber+ Arbitrary Geolocation Record Modification and Deletion via IDORCVE-2026-152604.3 Medium
- unknown tag, category, and taxonomy managerTaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDORCVE-2026-152312.7 Low
- unknown softmarket — digital marketplaceSoftMarket <= 1.0.0 - Unauthenticated Account Takeover via Email Verification BypassCVE-2026-145579.1 Critical
- unknown svg supportSVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization BypassCVE-2026-133406.1 Medium
- unknown super store finder wordpressSuper Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_trackingCVE-2026-129659.1 Critical
- unknown webinfosWebinfos <= 1.2 - Unauthenticated Arbitrary File UploadCVE-2026-128729.8 Critical
- Show moreLoading…