Skip to contentUnknown vulnerabilities
Newest
- dell ecsECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater HandlersCVE-2026-188074.3 Medium
- unknown backup migrationBackup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-LoginCVE-2026-182166.5 Medium
- unknown product feed pro for woocommerce by adtribesProduct Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration DisclosureCVE-2026-166117.5 High
- nsquared simply schedule appointmentsSimply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST EndpointsCVE-2026-165416.5 Medium
- dell ecsECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater BindingsCVE-2026-142305.4 Medium
- dell ecsECS < 4.3.8 - Unauthenticated Private Content Disclosure via ecsloadCVE-2026-142295.3 Medium
- gamerz wp-statsWP-Stats <= 2.56 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-19794Public exploit7.2 High
- unknown essential addons for elementorEssential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass AssignmentCVE-2026-180398.1 High
- unknown epeken all kurir for woocommerceEpeken All Kurir <= 2.1.4 - Unauthenticated Order Payment Confirmation ForgeryCVE-2026-167395.9 Medium
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel LookupCVE-2026-152058.6 High
- pavex embed google photos albumEmbed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode AttributeCVE-2026-14290Public exploit6.8 Medium
- mailchimp for woocommerce, unknown mailchimp for woocommerce +1 moreWordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerabilityCVE-2026-733467.6 High
- afonso matos arvow ai seo writerWordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerabilityCVE-2026-664697.5 High
- thimpress realpressWordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerabilityCVE-2026-664589.3 Critical
- if-so dynamic content personalization, unknown if-so dynamic content personalization +1 moreWordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerabilityCVE-2026-664469.3 Critical
- pete nelson rest api logWordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerabilityCVE-2026-664437.5 High
- lester chan wp-statsWordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-664267.1 High
- unknown link factoryLink Factory - BackdoorCVE-2026-1541310.0 Critical
- ecwid by lightspeed ecommerce shopping cart, unknown ecwid by lightspeed ecommerce shopping cart +1 moreEcwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' ActionCVE-2026-143325.4 Medium
- buildwps ppwp – password protect pagesPPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesCVE-2026-36396.4 Medium
- unknown shopengine elementor woocommerce builder addonShopEngine < 4.9.3 - Customer PII Disclosure via Forced AuthenticationCVE-2026-190885.4 Medium
- mat bao corporation wp helper premiumWP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key ValidationCVE-2026-189458.2 High
- unknown booking for appointments and events calendarAmelia < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDORCVE-2026-142133.7 Low
- unknown customer email verification for woocommerceCustomer Email Verification for WooCommerce < 3.2.6 - Unauthenticated Account Takeover via Type-Juggling Authentication BypassCVE-2026-141829.8 Critical
- iqonic design kivicareKiviCare < 4.5.2 - Unauthenticated Privilege Escalation via RegistrationCVE-2026-13610Public exploit7.5 High
- unknown food menuTLP Food Menu < 6.0.2 - Unauthenticated Reservation Status ModificationCVE-2026-133285.3 Medium
- unknown estatik real estate pluginEstatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value MismatchCVE-2026-180443.7 Low
- fullworks quick paypal paymentsQuick PayPal Payments <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPNCVE-2026-170085.3 Medium
- naa986 payment button for paypalPayment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price ManipulationCVE-2026-169905.3 Medium
- themeum kirkiKirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email ActionsCVE-2026-167476.5 Medium
- easy payment payment gateway for paypal on woocommercePayment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return HandlerCVE-2026-166215.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.11.33 - Unauthenticated Payment Bypass via Forged Settlement CallbackCVE-2026-152135.3 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet AmountCVE-2026-150456.5 Medium
- essekia tablesome tableWordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerabilityCVE-2026-666599.3 Critical
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box WidgetCVE-2026-192175.4 Medium
- unknown order sync with zendesk for woocommerceOrder Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Customer Order Data DisclosureCVE-2026-190735.3 Medium
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog CallsCVE-2026-190524.3 Medium
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.9 - Subscriber+ SSRF via proSol_url_validateCVE-2026-190506.4 Medium
- opajaap wp photo album plusWP Photo Album Plus < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing AuthorizationCVE-2026-189624.3 Medium
- unknown wpc admin columnsWPC Admin Columns < 2.3.4 - Subscriber+ Arbitrary User/Post/Term Meta DisclosureCVE-2026-189436.5 Medium
- unknown ezoicEzoic < 2.23.1 - Unauthenticated Database Export via Content Export REST RoutesCVE-2026-187897.5 High
- unknown wp directory kitWP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_categoryCVE-2026-184748.6 High
- unknown woocommerce subscriptionsWooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object InjectionCVE-2026-183919.8 Critical
- pixelite events managerEvents Manager < 7.4.1 - Unauthenticated Privilege Escalation to AdministratorCVE-2026-18366Public exploit9.8 Critical
- unknown wp directory kitWP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section ParameterCVE-2026-182308.1 High
- pixelite events managerEvents Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL InjectionCVE-2026-180578.1 High
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Unauthenticated Option Disclosure via gettogoCVE-2026-180497.5 High
- opajaap wp photo album plusWP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path TraversalCVE-2026-180487.5 High
- termly cookie consentCookie Consent < 0.0.10 - Subscriber+ MaxMind License Key UpdateCVE-2026-180464.3 Medium
- unknown user access managerUser Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST APICVE-2026-180355.3 Medium
- Show moreLoading…