Skip to contentUnknown vulnerabilities
Newest
- unknown ht contact formHT Contact Form < 2.9.3 - Unauthenticated Saved Form Draft Data DisclosureCVE-2026-142067.5 High
- unknown advanced excerptAdvanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis SettingCVE-2026-137014.8 Medium
- unknown autonettv relayAutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync CronCVE-2026-136008.1 High
- arraytics eventinEventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template SettingCVE-2026-131707.2 High
- thimpress learnpressLearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_featureCVE-2026-129712.2 Low
- cubewp1211 cubewp frameworkCubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDORCVE-2026-170184.9 Medium
- unknown saitama addon packSaitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post MetaCVE-2026-170105.4 Medium
- owthub library management systemLibrary Management System < 3.6.7 - Subscriber+ SQL Injection via Filter ValueCVE-2026-186664.3 Medium
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password ResponseCVE-2026-18470Public exploit7.5 High
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute ForceCVE-2026-184698.1 High
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address HeaderCVE-2026-184688.1 High
- unknown accept paypal & stripe with subscriptions for woocommerceRestore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT UnderpaymentCVE-2026-170163.7 Low
- unknown accept paypal & stripe with subscriptions for woocommerceRestore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_emailCVE-2026-170125.3 Medium
- bricksforgeBricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro FormsCVE-2026-180308.1 High
- crocoblock jetengineJetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG)CVE-2026-170196.1 Medium
- britcoder single sign on for tngSingle Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password ResetCVE-2026-162999.8 Critical
- unknown foodboxbookerFoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password ResetCVE-2026-162989.8 Critical
- unknown arvow ai seo writerArvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-JugglingCVE-2026-162578.2 High
- mndpsingh287 file managerBit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connectorCVE-2026-175427.5 High
- mndpsingh287 file managerBit File Manager < 6.9.1 - Unauthenticated File Activity Log DisclosureCVE-2026-175417.5 High
- mndpsingh287 file managerBit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source MismatchCVE-2026-175408.8 High
- cubewp1211 cubewp frameworkCubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relationCVE-2026-170178.1 High
- lws optimize, unknown lws optimize +1 moreLWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User MonitoringCVE-2026-160326.1 Medium
- infinitewp client, unknown infinitewp client +1 moreInfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on MultisiteCVE-2026-15038Public exploit9.8 Critical
- unknown piweb cancel order / refund request for woocommerceCancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX ActionsCVE-2026-186036.5 Medium
- unknown wp directory kitWP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' ParameterCVE-2026-184739.1 Critical
- flippercode wp maps proWP Maps Pro < 6.1.3 - Unauthenticated Local File InclusionCVE-2026-184656.5 Medium
- flippercode wp maps proWP Maps Pro < 6.1.3 - Unauthenticated Denial of ServiceCVE-2026-18464Public exploit7.5 High
- unknown wpc order tip for woocommerceWPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data DisclosureCVE-2026-183577.5 High
- catch themes createCreate by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and PublicationCVE-2026-180376.5 Medium
- passionate programmer peter wp data accessWP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization BypassCVE-2026-180327.5 High
- nickboss iptanus file uploadWordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadidCVE-2026-170448.6 High
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzipsCVE-2026-170145.3 Medium
- posimyth nexter blocksNexter Blocks < 5.0.2 - Contributor+ Stored CSS InjectionCVE-2026-170113.8 Low
- catch themes createCreate by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and PublicationCVE-2026-169926.5 Medium
- paolo geodirectoryGeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST EndpointCVE-2026-169887.5 High
- solacewp solace extraSolace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_statusCVE-2026-169654.3 Medium
- anh tran slim seoSlim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta DisclosureCVE-2026-169572.7 Low
- jordy meow ai engineAI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio TranscriptionCVE-2026-169555.0 Medium
- jordy meow ai engineAI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session CookieCVE-2026-169534.8 Medium
- solacewp solace extraSolace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce ExposureCVE-2026-169488.1 High
- unknown download monitorDownload Monitor < 5.2.6 - Unauthenticated Download Log InjectionCVE-2026-166085.3 Medium
- unknown wp directory kitWP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing DisclosureCVE-2026-165956.5 Medium
- unknown wp directory kitWP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key DisclosureCVE-2026-165947.5 High
- unknown wp directory kitWP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data DisclosureCVE-2026-165906.5 Medium
- unknown wp directory kitWP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list ParameterCVE-2026-165897.7 High
- unknown admin safety guard — login security, limit logins, 2fa & brute force protectionAdmin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST RouteCVE-2026-165787.5 High
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST EndpointCVE-2026-165745.4 Medium
- unknown wp statisticsWP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX HandlersCVE-2026-165626.5 Medium
- unknown ymc filterYMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon UploadCVE-2026-165596.8 Medium
- Show moreLoading…