Skip to contentUnknown vulnerabilities
Newest
- unknown appointment booking calendar plugin and scheduling pluginBookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment ConfirmationCVE-2026-765867.5 High
- unknown user profile builderProfile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth BypassCVE-2026-765488.2 High
- unknown user profile builderProfile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/ExportCVE-2026-76547Public exploit6.6 Medium
- unknown user profile builderProfile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date ShortcodeCVE-2026-765466.8 Medium
- unknown catfolders document gallery proCatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-allCVE-2026-194305.3 Medium
- mstore api, unknown mstore api +1 moreMStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via WalletCVE-2026-182346.5 Medium
- mstore api, unknown mstore api +1 moreMStore API < 4.21.1 - Subscriber+ Arbitrary Order CompletionCVE-2026-182336.5 Medium
- tribulant software newslettersNewsletters < 4.17 - Arbitrary Plugin Option Update via CSRFCVE-2026-175225.4 Medium
- tribulant software newslettersNewsletters < 4.17 - Unauthenticated API Access via Predictable API KeyCVE-2026-175204.8 Medium
- totalprocessing total processing card payments for woocommerceTotal Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential DisclosureCVE-2026-169479.1 Critical
- unknown smartaipressSmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_imageCVE-2026-166007.7 High
- unknown uix usercenterUix UserCenter <= 1.0.3 - Unauthenticated Privilege EscalationCVE-2026-162599.8 Critical
- unknown rest routesRest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}CVE-2026-160618.6 High
- unknown memberheroSimple User Registration <= 6.9 - Unauthenticated Privilege Escalation to AdministratorCVE-2026-105229.8 Critical
- unknown user registration & membershipUser Registration & Membership < 5.2.6 - Authenticated Privilege Escalation via Login SettingsCVE-2026-799967.2 High
- unknown user registration & membershipUser Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDORCVE-2026-799954.3 Medium
- cloudways breeze cacheBreeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path TraversalCVE-2026-797065.3 Medium
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Question Bank and Answer Key Disclosure via IDORCVE-2026-796152.7 Low
- unknown wcfm marketplaceWCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest OrdersCVE-2026-777015.3 Medium
- ultimate member member, unknown ultimate member +1 moreUltimate Member 2.6.7 - 2.12.1 - Unauthenticated Privilege Escalation via Role Field on Profile FormsCVE-2026-194238.1 High
- unknown shared-files-proShared Files < 1.7.70 - Unauthenticated Arbitrary File ReadCVE-2026-190847.5 High
- unknown user frontendWP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User DirectoryCVE-2026-145675.3 Medium
- unknown user frontendWP User Frontend < 4.3.10 - Editor+ PHP Object Injection via AI Form BuilderCVE-2026-145587.2 High
- unknown shared files, shared-files-pro +1 moreShared Files < 1.7.70 - Unauthenticated Limited File UploadCVE-2026-125145.3 Medium
- unknown shared files, shared-files-pro +1 moreShared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path TraversalCVE-2026-12513Public exploit6.8 Medium
- onedesigns one user avatar | user profile pictureOne User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file ParameterCVE-2026-189837.5 High
- themeum tutor lmsTutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable ShadowingCVE-2026-190929.8 Critical
- unknown ctn720-w1, lf-1541, mt7620n +13 more +15 moreZbtlink MQWrt infosrvd Command InjectionCVE-2026-74233Known exploited9.3 Critical
- morequick mqac-7620, mqac-7620a, mqap-7620 +12 more +14 moreZbtlink MQWrt yunmgrd Cloud C2 ImplantCVE-2026-74232Known exploited9.3 Critical
- murali push notification for post and buddypressWordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerabilityCVE-2026-812795.4 Medium
- aa web servant 12 step meeting list12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event LogCVE-2026-783338.8 High
- unknown notifimaNotifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDORCVE-2026-781394.3 Medium
- daman jeet finale liteFinale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_htmlCVE-2026-781384.3 Medium
- unknown storegrowthStoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-CartCVE-2026-781377.5 High
- thimpress learnpressLearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status DisclosureCVE-2026-781255.3 Medium
- unknown workeeraWorkeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass AssignmentCVE-2026-770188.8 High
- unknown workeeraWorkeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass AssignmentCVE-2026-770177.7 High
- unknown workeeraWorkeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass AssignmentCVE-2026-770169.6 Critical
- davidanderson updraftplus: wp backup & migration pluginUpdraftPlus < 1.26.7 - Backup Restoration via CSRFCVE-2026-765495.9 Medium
- unknown wp oauth server ( login with wordpress )WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log FileCVE-2026-197157.5 High
- unknown jetbackupJetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup DownloadCVE-2026-194544.4 Medium
- unknown defender securityDefender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on MultisiteCVE-2026-192256.6 Medium
- unknown smushSmush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on MultisiteCVE-2026-192237.2 High
- unknown mobile app for woocommerce: shopapper mobile app builder service for woocommerceShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock UpdateCVE-2026-165694.3 Medium
- unknown mobile app for woocommerce: shopapper mobile app builder service for woocommerceShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDORCVE-2026-165684.3 Medium
- unknown document embedderDocument Embedder < 2.3.1 - Unauthenticated Private Document Download via Token OracleCVE-2026-165675.3 Medium
- unknown cmpCMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmediaCVE-2026-134163.5 Low
- unknown cmpCMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settingsCVE-2026-134157.2 High
- unknown cmpCMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajaxCVE-2026-134144.8 Medium
- unknown simple newsletter pluginNoptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions PageCVE-2026-781466.5 Medium
- Show moreLoading…