Skip to contentUnknown vulnerabilities
Newest
- metagauss registrationmagicRegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating FieldCVE-2026-777927.5 High
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemasCVE-2026-777884.9 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulkCVE-2026-777872.7 Low
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities APICVE-2026-777852.7 Low
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_asCVE-2026-777842.7 Low
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content DisclosureCVE-2026-777833.7 Low
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txtCVE-2026-777825.3 Medium
- ruben garcia gamipressGamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video ListenersCVE-2026-777644.3 Medium
- multivendorxMultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST EndpointCVE-2026-749275.3 Medium
- unknown social media share buttons & social sharing iconsSocial Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share HandlerCVE-2026-197237.1 High
- unknown social media share buttons & social sharing iconsSocial Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post TitleCVE-2026-197196.8 Medium
- unknown commentsComments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLiCVE-2026-197045.3 Medium
- unknown jetbackupJetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User SelectionCVE-2026-194537.1 High
- ultimate member member, unknown ultimate member +1 moreUltimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile ActivityCVE-2026-192515.3 Medium
- unknown user frontendWP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit FormCVE-2026-191168.8 High
- gutentorGutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST APICVE-2026-169834.3 Medium
- solacewp solace extraSolace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_contentCVE-2026-169665.3 Medium
- jetmonsters motopress appointment bookingAppointment Booking Lite < 2.4.8 - Unauthenticated Arbitrary Reservation DeletionCVE-2026-152325.3 Medium
- unknown booking for appointments and events calendarAmelia < 2.4.9 - Unauthenticated Post-Booking Action TriggerCVE-2026-142156.5 Medium
- 10web photo gallery by 10webPhoto Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged ParametersCVE-2026-128657.1 High
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionCVE-2026-125268.1 High
- unknown ultimate before after image slider & galleryBEAF < 4.7.19 - Author+ Stored XSS via Before LabelCVE-2025-156646.8 Medium
- unknown ultimate before after image slider & galleryBEAF < 4.7.19 - Author+ Stored XSS via After LabelCVE-2025-156636.8 Medium
- iqonic design kivicareKiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data DisclosureCVE-2026-136115.3 Medium
- unknown mw wp formMW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge TagsCVE-2026-783634.8 Medium
- unknown wp fastest cacheWP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking ParametersCVE-2026-749166.5 Medium
- levelfourstorefront shopping cart & ecommerce storeShopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' ParameterCVE-2026-175894.9 Medium
- unknown throws spam awayWordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerabilityCVE-2026-817639.3 Critical
- unknown leadconnectorWordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-812987.1 High
- unknown typoraTypora Mermaid Rendering cross site scriptingCVE-2026-828055.3 Medium
- unknown 爱采集数据采集和发布插件Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method DispatchCVE-2026-770135.3 Medium
- unknown really simple securityReally Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_pluginCVE-2026-817666.6 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio FieldCVE-2026-816608.8 High
- unknown mw wp formMW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data ListCVE-2026-783643.5 Low
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' ParameterCVE-2026-765858.8 High
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup RestoreCVE-2026-197226.6 Medium
- unknown geotargetingwpGeotargeting WP < 3.5.6.2 - Reflected XSSCVE-2026-143077.1 High
- unknown sogo add script to individual pages header footerSOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post MetaboxCVE-2026-148356.8 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan DeletionCVE-2026-813464.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.43 - Unauthenticated Open RedirectCVE-2026-813424.7 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDORCVE-2026-812002.7 Low
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPNCVE-2026-810264.8 Medium
- unknown wp ultimate csv importerWP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import FieldsCVE-2026-804884.1 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDORCVE-2026-803114.3 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Editor+ Core Settings Modification via fix-site-seo AbilityCVE-2026-777864.9 Medium
- unknown booking for appointments and events calendarAmelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-ApprovalCVE-2026-777042.7 Low
- unknown 爱采集数据采集和发布插件Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing PasswordCVE-2026-770129.3 Critical
- higheredlab hel online classroom: ai-powered online classroomsHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code BypassCVE-2026-770106.5 Medium
- higheredlab hel online classroom: ai-powered online classroomsHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings UpdateCVE-2026-770086.5 Medium
- higheredlab hel online classroom: ai-powered online classroomsHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret DisclosureCVE-2026-770077.5 High
- Show moreLoading…