Skip to contentUnknown vulnerabilities
Newest
- unknown product shortlistProduct Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_productsCVE-2026-169508.6 High
- mitchell bennis simple file listSimple File List <= 6.3.11 - Unauthenticated Stored XSS via File DescriptionCVE-2026-166178.8 High
- mitchell bennis simple file listSimple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path TraversalCVE-2026-166168.6 High
- nextscripts nextscripts: social networks auto-posterNextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth CallbackCVE-2026-165707.1 High
- unknown yaycurrencyYayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan IntegrationCVE-2026-160585.3 Medium
- nabil lemsieh easy media replaceEasy Media Replace <= 0.2.0 - Author+ Stored XSS via Attachment TitleCVE-2026-15253Public exploit6.8 Medium
- pickplugins user verification by pickpluginsUser Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDORCVE-2026-148617.5 High
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDORCVE-2026-148262.7 Low
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDORCVE-2026-148252.7 Low
- unknown booking calendar, appointment booking systemBooking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File UploadCVE-2026-143348.8 High
- unknown 10web boosterTenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token BypassCVE-2026-142874.7 Medium
- unknown wcfm marketplaceWCFM Marketplace < 3.8.1 - Store Vendor+ Cross-Vendor Review Deletion and Status Update via IDORCVE-2026-141964.3 Medium
- arraytics eventinEventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDORCVE-2026-131756.5 Medium
- arraytics eventinEventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDORCVE-2026-131747.2 High
- arraytics eventinEventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker CreationCVE-2026-131732.7 Low
- arraytics eventinEventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDORCVE-2026-131698.1 High
- unknown dinaturDinatur <= 1.18 - Unauthenticated SQL Injection via Column Name InjectionCVE-2026-129838.6 High
- saad iqbal advanced file managerAdvanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_uiCVE-2026-115658.5 High
- buildwps ppwp – password protect pagesPPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password ExposureCVE-2025-117294.3 Medium
- sureformsSureForms contains an uncontrolled resource consumption vulnerabilityCVE-2026-19500Public exploit7.5 High
- sureformsCVE-2026-19501CVE-2026-19501Public exploit8.8 High
- nexcess starter templates by kadence wpWordPress Starter Templates by Kadence WP plugin <= 2.3.3 - Denial of Service Attack vulnerabilityCVE-2026-739977.5 High
- unknown subscribe2WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-733937.1 High
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-733827.1 High
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerabilityCVE-2026-733777.5 High
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerabilityCVE-2026-733769.8 Critical
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-733757.1 High
- kaizencoders url shortifyWordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-733627.1 High
- autopayWordPress Autopay plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-733387.1 High
- unknown wufoo shortcodeWordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-666436.5 Medium
- 10web slider by 10webWordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-666357.4 High
- ezoicWordPress Ezoic plugin <= 2.22.11 - Broken Authentication vulnerabilityCVE-2026-324817.5 High
- ssl zen zen, unknown ssl zen +1 moreWordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2026-285697.1 High
- unknown shopsmart loyalty for woocommerceShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phoneCVE-2026-148325.3 Medium
- unknown woomsWooMS <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information DisclosureCVE-2026-137005.9 Medium
- edgarrojas extra product options builder for woocommerceExtra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileuploadCVE-2026-197287.5 High
- themeisle visualizerVisualizer < 4.0.7 - Contributor+ Cross-User Chart Configuration DisclosureCVE-2026-197266.5 Medium
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.131 - Unauthenticated Path Traversal via send_to_site_connectCVE-2026-197259.1 Critical
- unknown catfolders document gallery & pdf libraryCatFolders Document Gallery < 2.0.7 - Unauthenticated Attachment Disclosure via REST APICVE-2026-197177.5 High
- nicu micle simple jwt loginSimple JWT Login < 3.6.8 - Unauthenticated Account Takeover via Missing Google id_token Audience ValidationCVE-2026-197149.1 Critical
- unknown masteriyo lmsMasteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz DescriptionCVE-2026-197126.1 Medium
- shahjada premium packagesPremium Packages – Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal RequestCVE-2026-197116.5 Medium
- dell ecsECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF SourceCVE-2026-196136.5 Medium
- unknown wp directory kitWP Directory Kit < 1.5.7 - Admin+ SQL Injection via section ParameterCVE-2026-186537.2 High
- servmask all-in-one wp migration and backupAll-in-One WP Migration and Backup < 7.108 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST ImportCVE-2026-175337.2 High
- unknown manual image cropManual Image Crop < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDORCVE-2026-153845.7 Medium
- elegant themes diviDivi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URLCVE-2026-137125.4 Medium
- bluemediapl autopayAutopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' ParameterCVE-2026-150027.2 High
- buildwps ppwp – password protect pagesPassword Protect WordPress Lite <= 1.9.20 - Insecure Direct Object Reference to Authenticated (Contributor+) Password Protected Post Password UpdateCVE-2025-100054.3 Medium
- cedcommerce wholesale marketWholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' ParameterCVE-2026-142798.8 High
- Show moreLoading…