Skip to contentUnknown vulnerabilities
Newest
- profilepress membership team profilepressProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display NameCVE-2026-198486.5 Medium
- unknown limit login attempts securityLimit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account EmailCVE-2026-183563.7 Low
- unknown passsterContent Protector (Passster) < 4.3.9 - Unauthenticated Protected Content Disclosure via REST Path Allowlist BypassCVE-2026-175595.3 Medium
- syed balkhi charitableCharitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature BypassCVE-2026-166505.3 Medium
- saad iqbal mycredmyCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCREDCVE-2026-151505.3 Medium
- unknown litextensionLitExtension: Store to WooCommerce Migration <= 1.2.5 - Connector Token Takeover via CSRFCVE-2026-150464.2 Medium
- arraytics eventinEventin < 4.1.21 - Contributor+ Server-Side Request ForgeryCVE-2026-131762.7 Low
- jordy meow ai engineAI Engine 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User ToolsCVE-2026-757967.2 High
- copydeleteposts duplicate postCopy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password DisclosureCVE-2026-194352.7 Low
- copydeleteposts duplicate postCopy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content DisclosureCVE-2026-190852.7 Low
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Unauthenticated RCE via Control Character Filename BypassCVE-2026-187818.1 High
- david lingren media library assistantMedia Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connectorCVE-2026-169596.8 Medium
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied AmountCVE-2026-165772.7 Low
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST APICVE-2026-165767.2 High
- unknown dokan: ai powered woocommerce multivendor marketplace solutionDokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST EndpointCVE-2026-165755.3 Medium
- unknown link whisper freeLink Whisper < 0.9.7 - Editor+ SQL Injection via domain ParameterCVE-2026-146016.8 Medium
- dev@tamara.co tamara checkoutTamara Checkout <= 1.9.9.20 - Unauthenticated Order Status ManipulationCVE-2026-169625.3 Medium
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag SettingCVE-2026-143253.5 Low
- unknown newpath wildapricotpress add-onNewPath WildApricotPress Add-on – Member Directory <= 1.0.0 - Unauthenticated Member PII Disclosure via REST APICVE-2026-13736Public exploit5.3 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.1 - Session Fixation via uscesid ParameterCVE-2025-156715.4 Medium
- 10web form maker by 10webWordPress Form Maker by 10Web plugin <= 1.15.49 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-666167.1 High
- unknown json optionsJSON Options <= 0.0.4 - Unauthenticated Arbitrary Options UpdateCVE-2026-758609.8 Critical
- themeum kirkiKirki < 6.2.3 - Editor+ Stored XSS via Font Zip UploadCVE-2026-749926.8 Medium
- ataur r gutenkitGutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data DisclosureCVE-2026-196992.7 Low
- ataur r gutenkitGutenKit < 2.5.0 - Author+ Stored XSS via SVG UploadCVE-2026-196976.8 Medium
- bowo admin and site enhancements (ase)Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPCCVE-2026-196156.8 Medium
- averta depicter — popup & slider builderDepicter < 4.8.0 - Editor+ Arbitrary File Upload via ZIP ImportCVE-2026-150497.2 High
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget BuilderCVE-2026-134056.6 Medium
- liedekef events made easyEvents Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event PropertyCVE-2026-759637.5 High
- peepso community by peepsoWordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerabilityCVE-2026-666688.5 High
- unknown saml single sign onSAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor OverwriteCVE-2026-198428.8 High
- nicolaskulka wps bidouilleWPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_usersCVE-2026-197825.4 Medium
- unknown membership for woocommerceMembership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret BypassCVE-2026-197095.3 Medium
- iqonic design kivicareKiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDORCVE-2026-194176.5 Medium
- iqonic design kivicareKiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDORCVE-2026-194164.3 Medium
- easyappointments easy appointmentsEasy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments ListingCVE-2026-194062.7 Low
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.11 - Reflected XSS via 'page' ParameterCVE-2026-190567.1 High
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.11 - Reflected XSS via Multiple ParametersCVE-2026-190557.1 High
- unknown broken link checkerBroken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable InjectionCVE-2026-18937Public exploit9.0 Critical
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_bookedCVE-2026-187795.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX ActionsCVE-2026-187785.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_statusCVE-2026-187775.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX ActionsCVE-2026-187769.8 Critical
- unknown wp mapsWP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option CreationCVE-2026-184665.4 Medium
- unknown wp directory kitWP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_userCVE-2026-182315.3 Medium
- crocoblock jetengineJetEngine < 3.8.14 - Author+ Stored XSS via SVG UploadCVE-2026-182026.8 Medium
- boldgrid w3 total cacheW3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache KeyCVE-2026-1805110.0 Critical
- unknown tabapay gatewayTabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment CallbackCVE-2026-180319.8 Critical
- unknown animation addons for elementorAnimation Addons for Elementor < 2.7.2 - Unauthenticated Server-Side Request ForgeryCVE-2026-175657.2 High
- unknown smartcrawl seo checker, analyzer & optimizerSmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key EnumerationCVE-2026-169794.3 Medium
- Show moreLoading…