Skip to contentUnknown vulnerabilities
Newest
- monsterinsights pro, unknown monsterinsights pro +1 moreMonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromiseCVE-2026-1197610.0 Critical
- unknown datapress (dataverse integration)Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information DisclosureCVE-2026-53366.8 Medium
- constant contact creative mailCreative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLiCVE-2026-34308.6 High
- facebook for wordpress, unknown facebook for wordpress +1 moreWordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-667057.1 High
- nickboss wordpress file uploadWordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerabilityCVE-2026-664479.3 Critical
- berocket advanced ajax product filtersWordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-664397.1 High
- jegtheme jeg kit for elementorWordPress Jeg Elementor Kit plugin <= 3.2.10 - PHP Object Injection vulnerabilityCVE-2026-655497.2 High
- unknown captcha 4wpWordPress CAPTCHA 4WP plugin <= 7.6.0 - Captcha Bypass vulnerabilityCVE-2026-324695.3 Medium
- data443 risk mitigation, inc. tracking code managerWordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerabilityCVE-2026-281727.1 High
- inspirythemes realhomes membershipsRealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment BypassCVE-2026-152464.3 Medium
- unknown google authenticatorGoogle Authenticator < 0.56 - 2FA Secret Overwrite via CSRFCVE-2026-142046.5 Medium
- unknown seo redirection pluginSEO Redirection Plugin – 301 Redirect Manager < 9.19 - Subscriber+ Redirect Rule DisclosureCVE-2026-137035.4 Medium
- unknown gutenberg essential blocksEssential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries EndpointCVE-2026-131547.5 High
- unknown gutenberg essential blocksEssential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products EndpointCVE-2026-131537.5 High
- arni cinco wpcargo track & traceWPCargo Track & Trace < 8.0.4 - Unauthenticated SQL Injection via wpcargo_tracking_numberCVE-2026-127139.1 Critical
- posimyth nexter blocksNexter Blocks < 5.0.2 - Author+ Stored XSS via SVG UploadCVE-2025-156786.1 Medium
- unknown child pages cardChild Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode AttributesCVE-2026-183955.4 Medium
- unknown slick sliderSlick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery ShortcodeCVE-2026-165375.4 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV ImportCVE-2026-160656.5 Medium
- unknown checkimate — woocommerce checkout, abandoned cart recovery & order bumpsCheckimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded SecretCVE-2026-148298.2 High
- unknown eonsr aeo agentEONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post CreationCVE-2026-115886.1 Medium
- pixelite events managerEvents Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploadsCVE-2026-180507.5 High
- jordy meow ai engineAI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer TokensCVE-2026-169546.5 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount ManipulationCVE-2026-167347.5 High
- metagauss profilegridProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_groupCVE-2026-162905.3 Medium
- tribulant software newslettersNewsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce HandlerCVE-2026-162688.2 High
- glenwpcoder drag and drop multiple file upload for woocommerceDrag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce OracleCVE-2026-160549.1 Critical
- unknown estatik real estate pluginEstatik Real Estate Plugin < 4.3.3 - Unauthenticated Arbitrary-Recipient Mail Relay via Request FormCVE-2026-145475.3 Medium
- goodlayers tourmasterTourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order ExportCVE-2026-142405.3 Medium
- pepro dev. group peprodev woocommerce receipt uploaderPeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDORCVE-2026-143145.3 Medium
- pepro dev. group peprodev woocommerce receipt uploaderPeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDORCVE-2026-143135.3 Medium
- inisev backup migrationBackup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' ParameterCVE-2026-76937.2 High
- gm alex user access managerUser Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL InjectionCVE-2026-152816.5 Medium
- unknown mlsimport: idx plugin & mls plugin for real estate listingsMLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_itemCVE-2026-175154.3 Medium
- unknown contest galleryContest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_loginCVE-2026-160557.5 High
- unknown miniorange 2faminiOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor RebindingCVE-2026-160367.5 High
- unknown wp 2faWP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys ProviderCVE-2026-153727.5 High
- darren cooney ajax load moreAjax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_argsCVE-2026-153609.1 Critical
- glboy otp login with phone number, otp verificationLogin/Signup with Phone Number, OTP Verification < 1.8.71 - Unauthenticated Account Takeover via OTP Brute ForceCVE-2026-152109.1 Critical
- unknown dhl shipping germany for woocommerceDHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads DirectoryCVE-2026-169933.7 Low
- unknown dhl shipping germany for woocommerceDHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDORCVE-2026-169815.3 Medium
- unknown yaypricingYayPricing < 3.5.7 - Subscriber+ Pricing Configuration Modification and Coupon Code DisclosureCVE-2026-152308.1 High
- unknown zportalsZportals < 6.3.4 - Subscriber+ Arbitrary File UploadCVE-2026-145538.1 High
- paolo geodirectoryGeoDirectory < 2.8.110 - Editor+ Stored XSS via Place CategoriesCVE-2025-156773.5 Low
- paolo geodirectoryGeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_usersCVE-2026-169686.5 Medium
- unknown wp custom html pageWP Custom HTML Pages <= 0.6.2 - Author+ Stored XSSCVE-2026-169425.4 Medium
- unknown custom fieldsCustom Fields for WooCommerce < 1.5.1 - Unauthenticated Arbitrary File Deletion via Path TraversalCVE-2026-1694010.0 Critical
- multivendorxMultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST EndpointCVE-2026-167462.7 Low
- unknown user registration & membershipUser Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration DisabledCVE-2026-167367.5 High
- unknown gdpr cookie complianceGDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRFCVE-2026-166134.3 Medium
- Show moreLoading…