Skip to contentUnknown vulnerabilities
Newest
- metagauss registrationmagicRegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' ParameterCVE-2026-777905.5 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDORCVE-2026-777894.3 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed SessionCVE-2026-777585.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing SubmissionCVE-2026-777575.4 Medium
- themeum kirkiKirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apisCVE-2026-777545.3 Medium
- unknown return refund and exchange for woocommerceWoo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and ManipulationCVE-2026-776956.5 Medium
- arraytics eventinEventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_tokenCVE-2026-776945.3 Medium
- railmedia order tip for woocommerceOrder Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_exported_csv_file_ajaxCVE-2026-776938.7 High
- jordy meow ai engineAI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor AssistantCVE-2026-757985.3 Medium
- jordy meow ai engineAI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' ParameterCVE-2026-757977.7 High
- unknown project managerWP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDORCVE-2026-749304.3 Medium
- unknown project managerWP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDORCVE-2026-749295.4 Medium
- unknown project managerWP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import RoutesCVE-2026-749287.5 High
- unknown podsPods < 3.3.9.1 - Author+ RCE via Shortcode Display CallbackCVE-2026-748517.2 High
- unknown blogvault backup & staging, malcare wordpress security plugin, the wp remote wordpress plugin +2 moreBlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key RecoveryCVE-2026-197188.1 High
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect SettingsCVE-2026-192266.8 Medium
- unknown forminator formsForminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege EscalationCVE-2026-192203.7 Low
- themeum tutor lmsTutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' ParametersCVE-2026-190945.3 Medium
- masaakitanaka booking packageBooking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost ParametersCVE-2026-169865.3 Medium
- unknown privacy policy generator, terms & conditions, gdpr, ccpa, cookie policy & disclaimer templatesWP Legal Pages < 3.7.1 - Unauthenticated API Secret DisclosureCVE-2026-169846.5 Medium
- arraytics wpcafeWPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing AuthorizationCVE-2026-145505.3 Medium
- unknown booking for appointments and events calendarAmelia < 2.4.7 - Unauthenticated Notification Queue DispatchCVE-2026-142166.5 Medium
- unknown booking for appointments and events calendarAmelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDORCVE-2026-142124.7 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term DisclosureCVE-2026-134065.3 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_initCVE-2026-134045.3 Medium
- arraytics eventinEventin < 4.1.22 - Unauthenticated Unpublished Content DisclosureCVE-2026-131725.3 Medium
- unknown wp fastest cacheWP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache PoisoningCVE-2026-749327.5 High
- buildwps ppwp – password protect pagesPassword Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2025-98786.4 Medium
- franky events made easyWordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-281627.1 High
- tammersoft shared filesWordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerabilityCVE-2026-782696.4 Medium
- braveBrave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup Disclosure via PreviewCVE-2026-771164.3 Medium
- braveBrave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM ParametersCVE-2026-771157.1 High
- alex content maskContent Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_maskCVE-2026-770032.7 Low
- unknown woocommerce bookings, woocommerce bookings +1 moreWooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing AuthorizationCVE-2026-148534.3 Medium
- unknown restrictmateRestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to AdministratorCVE-2026-135989.8 Critical
- buildwps ppwp – password protect pagesPPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_rolesCVE-2026-05518.8 High
- mailgun for wordpress, unknown mailgun for wordpress +1 moreMailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array KeysCVE-2026-780039.8 Critical
- unknown smilepass selfie loginSmilePass Selfie Login <= 1.0.2 - Unauthenticated Authentication BypassCVE-2026-770029.8 Critical
- unknown social login & sharing buttons with analytics by socleverSocial Login & Sharing buttons with Analytics By SoClever <= 1.2.0 - Unauthenticated Authentication BypassCVE-2026-770019.8 Critical
- unknown wp social media loginWP Social Media Login <= 1.0.6 - Unauthenticated Account Takeover via Twitter Login FlowCVE-2026-770009.8 Critical
- unknown firebase authenticationFirebase Authentication < 1.7.1 - Unauthenticated Account Takeover via Firebase Email ClaimCVE-2026-767938.1 High
- quantumcloud slider hero with video background, animationSlider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider HandlersCVE-2026-767898.8 High
- unknown forminator formsForminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role BypassCVE-2026-192226.6 Medium
- unknown forminator formsForminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on MultisiteCVE-2026-192217.2 High
- themeum tutor lmsTutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video PathCVE-2026-190936.8 Medium
- managewp worker, unknown managewp worker +1 moreManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login ParametersCVE-2026-180528.1 High
- conekta group payment gateway, unknown conekta payment gateway +1 moreConekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook ForgeryCVE-2026-167385.3 Medium
- damian góra fibosearchFiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information DisclosureCVE-2026-166125.3 Medium
- unknown post grid, slider & carousel ultimatePost Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title FieldCVE-2026-162606.8 Medium
- themeum tutor lmsTutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDORCVE-2026-141872.7 Low
- Show moreLoading…