Skip to contentUnknown vulnerabilities
Newest
- brainstorm force sureformsWordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-853085.3 Medium
- nexcess bookitWordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerabilityCVE-2026-847675.3 Medium
- unknown mail mintWordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerabilityCVE-2026-847556.5 Medium
- unknown mail mintWordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerabilityCVE-2026-84753Public exploit9.8 Critical
- advanpix wp quicklatexWordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-817767.1 High
- drupal advanced searchAdvanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118CVE-2026-84910Fix available4.2 Medium
- unknown ajaxify commentsAjaxify Comments < 3.2 - Unauthenticated HTTP Header InjectionCVE-2026-28115.4 Medium
- unknown developer toolsDeveloper Tools <= 1.1.3 – Unauthenticated Arbitrary File UploadCVE-2025-93149.8 Critical
- unknown wp edit password protectedWp Edit Password Protected < 1.3.5 - Protection Bypass via REST APICVE-2025-89455.3 Medium
- unknown passsterPassster < 4.2.26 - Global Protection BypassCVE-2025-154905.3 Medium
- unknown passsterPassster < 4.2.24 - Password Protection BypassCVE-2025-154895.3 Medium
- unknown auto x lineAuto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints CallCVE-2025-154858.2 High
- 8 degree themes notification bar for wordpressNotification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data DisclosureCVE-2025-154815.3 Medium
- unknown livejournal shortcodeLiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via ShortcodeCVE-2024-37735.9 Medium
- unknown weaver show postsWeaver Show Posts < 1.8.1 - Admin+ PHP Object InjectionCVE-2023-33603.3 Low
- unknown xpro addonsXpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple WidgetsCVE-2026-835476.8 Medium
- unknown wp express checkoutWP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_paymentCVE-2026-835335.3 Medium
- unknown all in one seoAll in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant BlockCVE-2026-828846.8 Medium
- braveBrave Popup Builder < 0.8.8 - Unauthenticated Arbitrary Shortcode Execution via UTM ParameterCVE-2026-815714.8 Medium
- unknown simple membership mailchimp integrationSimple Membership MailChimp Integration < 1.9.8 - API Key Update via CSRFCVE-2026-81515.4 Medium
- unknown restrict user accessRestrict User Access 2.6 - 2.8 - Unauthenticated Content Protection Bypass via REST API Route NormalizationCVE-2026-781535.3 Medium
- metagauss registrationmagicRegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero QuantityCVE-2026-777945.3 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.9.9 - Unauthenticated Payment Bypass via Omitted Price FieldCVE-2026-777935.3 Medium
- unknown watchman-site7WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug ConsoleCVE-2026-770099.9 Critical
- unknown embed html5 gameEmbed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File UploadCVE-2026-435710.0 Critical
- unknown hipaa formsCM HIPAA Forms < 3.2.0 - Unauthenticated Authorization BypassCVE-2026-26886.5 Medium
- ataur r gutenkitGutenKit < 2.5.1 - Contributor+ Stored CSS InjectionCVE-2026-196983.5 Low
- unknown user frontendWP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated FormCVE-2026-175635.3 Medium
- arraytics timeticsTimetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDORCVE-2026-143263.8 Low
- unknown yoast seo premiumYoast SEO Premium < 27.6.1 - Author+ Arbitrary .htaccess Directive Injection to RCECVE-2026-108216.6 Medium
- unknown icegram expressIcegram Express < 5.8.6 - Admin+ Stored XSSCVE-2025-156923.5 Low
- elementor activity logWordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-847597.1 High
- unknown oauth single sign onOAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID AssertionCVE-2026-821838.1 High
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner IsolationCVE-2026-821824.1 Medium
- jeff starr simple ajax chatSimple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message LinkificationCVE-2026-818078.8 High
- ays pro faq builder aysFAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_informationCVE-2026-817378.8 High
- jeff farthing theme my loginTheme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege EscalationCVE-2026-815835.4 Medium
- unknown jetstylemanager for gutenbergJetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRFCVE-2026-814324.3 Medium
- unknown wc vendorsWC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDORCVE-2026-814286.5 Medium
- unknown wc vendorsWC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status ChangeCVE-2026-814274.3 Medium
- unknown wc vendorsWC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRFCVE-2026-814264.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST RouteCVE-2026-811995.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDORCVE-2026-811983.8 Low
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST RouteCVE-2026-811975.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDORCVE-2026-811962.7 Low
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST RouteCVE-2026-811955.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id ParameterCVE-2026-811944.3 Medium
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert ActionCVE-2026-80467Public exploit8.1 High
- unknown catalogxCatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared TransientCVE-2026-796214.3 Medium
- softaculous formlayerFormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission ResponseCVE-2026-781515.3 Medium
- Show moreLoading…