Skip to contentUnknown vulnerabilities
Newest
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstartCVE-2026-170136.1 Medium
- unknown form maker by 10webForm Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_nameCVE-2026-169778.1 High
- unknown wp travel engine, wp travel engine travel engine +1 moreWP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cartCVE-2026-167375.3 Medium
- subratamal wallet for woocommerceTeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-UpCVE-2026-165389.1 Critical
- blubrry powerpress podcasting plugin by blubrryBlubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URLCVE-2026-162947.1 High
- boldgrid total upkeepTotal Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secretCVE-2026-162537.5 High
- nanbu welcart e-commerceWelcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product NameCVE-2026-160665.4 Medium
- unknown wpmudev-updatesWPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install ActionCVE-2026-160519.8 Critical
- termly cookie consentCookie Consent < 0.0.10 - Subscriber+ Consent Settings Update and Consent Log DisclosureCVE-2026-153884.3 Medium
- unknown patterns kitPatterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup LinkCVE-2026-152495.4 Medium
- unknown giftwareGift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File UploadCVE-2026-150399.8 Critical
- unknown import wpImport WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File DownloadCVE-2026-149257.5 High
- unknown wp crowdfundingWP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing AuthorizationCVE-2026-148594.3 Medium
- unknown wp crowdfundingWP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDORCVE-2026-148584.3 Medium
- unknown wp crowdfundingWP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDORCVE-2026-148574.3 Medium
- iqonic design kivicareKiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST EndpointCVE-2026-136138.8 High
- iqonic design kivicareKiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDORCVE-2026-136124.3 Medium
- arraytics eventinEventin < 4.1.20 - Contributor+ Order Information Disclosure via IDORCVE-2026-131774.3 Medium
- arraytics eventinEventin < 4.1.20 - Unauthenticated Account Creation via Waiting List EndpointCVE-2026-131718.2 High
- arraytics eventinEventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST APICVE-2026-131686.5 Medium
- thimpress learnpressLearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI AssistantCVE-2026-129766.5 Medium
- jbhovik ray enterprise translationRay Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and DeletionCVE-2026-145494.3 Medium
- jbhovik ray enterprise translationRay Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token UpdateCVE-2026-145486.5 Medium
- tychesoftwares product input fields for woocommerceProduct Input Fields for WooCommerce < 2.0.2 - Unauthenticated Arbitrary File UploadCVE-2026-19089Public exploit9.8 Critical
- copydeleteposts duplicate postCopy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level AuthorizationCVE-2026-190776.5 Medium
- plugins360 all-in-one video galleryAll-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side Request Forgery via 'vdl' ParameterCVE-2026-190755.0 Medium
- pluginsware advanced classifieds & directory proAdvanced Classifieds & Directory Pro < 3.4.3 - Unauthenticated Non-Public Listing Custom Field DisclosureCVE-2026-190745.3 Medium
- unknown checkviewCheckView < 2.3.2 - Administrator Account Creation via REST API Authentication BypassCVE-2026-187868.8 High
- unknown foodboxbookerFoodBoxBooker < 1.0.8 - Subscriber+ Arbitrary User Profile UpdateCVE-2026-182004.3 Medium
- cristián lávaque s2members2Member < 260805 - Contributor+ Stored XSS via ShortcodeCVE-2026-150476.8 Medium
- dimitri grassi salon booking systemSalon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth CallbackCVE-2026-170234.8 Medium
- unknown autopayAutopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS EditorCVE-2026-142938.8 High
- appsbd viteposVitepos < 3.6.0 - Admin+ SQL Injection via product-details-reportCVE-2026-142384.1 Medium
- appsbd viteposVitepos < 3.6.0 - Outlet Manager+ Privilege EscalationCVE-2026-142377.2 High
- unknown booking for appointments and events calendarAmelia Pro < 9.7 - Provider+ Arbitrary Customer Data Disclosure and Modification via IDORCVE-2026-142113.8 Low
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' ParameterCVE-2026-190539.1 Critical
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' CookieCVE-2026-190498.6 High
- dimitri grassi salon booking systemSalon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking WizardCVE-2026-170227.5 High
- dimitri grassi salon booking systemSalon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total TamperingCVE-2026-170215.3 Medium
- dimitri grassi salon booking systemSalon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII DisclosureCVE-2026-170204.3 Medium
- dotonpaper pinpoint booking systemPinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price ManipulationCVE-2026-152295.3 Medium
- unknown block user accountBlock User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application PasswordsCVE-2026-189605.4 Medium
- it path solutions pvt ltd contact form to any apiContact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable FilenameCVE-2026-189467.5 High
- unknown rss aggregator by feedzyRSS Aggregator by Feedzy < 5.2.6 - Author+ Cross-User Import Job Manipulation and Post DeletionCVE-2026-189345.5 Medium
- bogdan bendziukov squeezeSqueeze < 1.7.12 - Author+ Arbitrary File UploadCVE-2026-169858.8 High
- unknown term pagesTerm Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookupCVE-2026-169495.8 Medium
- jetmonsters motopress hotel bookingHotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDORCVE-2026-152385.4 Medium
- jetmonsters motopress hotel bookingHotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST EndpointCVE-2026-152375.3 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX ActionsCVE-2026-149415.4 Medium
- unknown podcast playerPodcast Player < 8.3.1 - Unauthenticated Server-Side Request ForgeryCVE-2026-148605.3 Medium
- Show moreLoading…