Skip to contentUnknown vulnerabilities
Newest
- unknown ymc filterYMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder SchemaCVE-2026-165585.4 Medium
- unknown link libraryLink Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabelCVE-2026-165356.1 Medium
- codepeople appointment hour bookingAppointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost ParameterCVE-2026-162825.3 Medium
- tribulant software newslettersNewsletters < 4.16 - Unauthenticated API Authentication Bypass via Type JugglingCVE-2026-162694.8 Medium
- tribulant software newslettersNewsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form FieldCVE-2026-162678.1 High
- unknown simple captcha with cloudflare turnstileSimple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache KeyCVE-2026-152395.3 Medium
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture TokenCVE-2026-152115.9 Medium
- thimpress wp events managerWP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDORCVE-2026-151485.3 Medium
- unknown wp mapsWP Maps < 4.9.7 - Subscriber+ Denial of ServiceCVE-2026-16265Public exploit6.5 Medium
- unknown wp mapsWP Maps < 4.9.7 - Subscriber+ Local File InclusionCVE-2026-162638.8 High
- unknown estatik real estate pluginEstatik < 4.3.3 - Login CSRFCVE-2026-162627.5 High
- unknown ajax search liteAjax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST EndpointCVE-2026-162589.8 Critical
- mstore api, unknown mstore api +1 moreMStore API < 4.21.0 - Unauthenticated Product Review CreationCVE-2026-160417.5 High
- mstore api, unknown mstore api +1 moreMStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDORCVE-2026-160396.5 Medium
- mstore api, unknown mstore api +1 moreMStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment GatewaysCVE-2026-160389.1 Critical
- mstore api, unknown mstore api +1 moreMStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone AuthenticationCVE-2026-160308.1 High
- jordy meow meow galleryMeow Gallery < 5.5.2 - Author+ Stored XSS via Attachment Alt-TextCVE-2026-153865.4 Medium
- unknown content viewsContent Views < 4.5 - Subscriber+ SQL Injection via preview_requestCVE-2026-153618.1 High
- unknown templatelyTemplately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection OverwriteCVE-2026-153596.5 Medium
- kerry kline bne testimonialsBNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider ShortcodeCVE-2026-152455.4 Medium
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin InstallationCVE-2026-152158.8 High
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDORCVE-2026-152144.3 Medium
- unknown commentswpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL ConversionCVE-2026-150326.1 Medium
- saadiqbal password protected — lock entire site, pages, posts, categories, and partial contentPassword Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST APICVE-2026-149437.5 High
- unknown subscribe2Subscribe2 < 10.46 - Reflected XSS via email ParameterCVE-2026-143316.1 Medium
- thimpress wp events managerWP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' ParameterCVE-2026-142059.8 Critical
- unknown passsterContent Protector (Passster) < 4.3.7 - Contributor+ Protected Content Disclosure via Core REST APICVE-2025-156742.7 Low
- unknown wpc name your price for woocommerceWPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select ModeCVE-2026-166207.5 High
- unknown miniorange 2faminiOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor AttemptsCVE-2026-166197.5 High
- unknown event booking manager for woocommerce (pro)Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket PriceCVE-2026-160675.3 Medium
- unknown ninja formsNinja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field DefaultCVE-2026-152564.8 Medium
- unknown google-maps-easy-pro, supsystic-gallery-pro, tables-generator-pro +2 moreSupsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update ServerCVE-2026-170329.8 Critical
- unknown security optimizerSecurity Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_passwordCVE-2026-133425.3 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal VerificationCVE-2026-152085.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price ManipulationCVE-2026-151495.3 Medium
- rustaurius five star restaurant reservationsFive Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDORCVE-2026-151475.3 Medium
- unknown cocartCoCart < 4.9.0 - Unauthenticated Arbitrary Price ManipulationCVE-2026-105247.5 High
- unknown simple membershipSimple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver VerificationCVE-2026-149365.3 Medium
- unknown easy bookingEasy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration BypassCVE-2026-148315.3 Medium
- ayecode ltd getpaidGetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN VerificationCVE-2026-129015.9 Medium
- unknown wp travel engine, wp travel engine travel engine +1 moreWP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount VerificationCVE-2026-125015.3 Medium
- thimpress wp hotel bookingWP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment BypassCVE-2026-151525.3 Medium
- unknown events made easyEvents Made Easy < 3.1.2 - Unauthenticated Payment BypassCVE-2026-148425.3 Medium
- easyappointments easy appointmentsEasy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist BypassCVE-2026-142252.7 Low
- unknown premium seoPremium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection)CVE-2026-1481210.0 Critical
- payment plugins for paypal woocommerce, unknown payment plugins for paypal woocommerce +1 morePayment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal OrderCVE-2026-133997.5 High
- themeum tutor lmsTutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check BypassCVE-2026-143064.3 Medium
- jconti payment gateway for redsys & woocommerce litePayment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmation via Unverified Inespay CallbackCVE-2026-125847.5 High
- unknown formidable formsFormidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription StatusCVE-2026-113615.9 Medium
- unknown integrate phonepe with woocommerceIntegrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID ReuseCVE-2026-105997.5 High
- Show moreLoading…