Skip to contentUnknown vulnerabilities
Newest
- unknown embedpressEmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews ModificationCVE-2026-849272.7 Low
- unknown embedpressEmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST RouteCVE-2026-849262.7 Low
- arraytics eventinEventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing AuthorizationCVE-2026-849014.9 Medium
- unknown vikwidgetsloaderVikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffixCVE-2026-848996.8 Medium
- arraytics eventinEventin < 4.1.21 - Contributor+ LFI via Event Layout MetaCVE-2026-848986.6 Medium
- kingaddons.com king addons for elementorKing Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid WidgetCVE-2026-848966.8 Medium
- stellarwp the events calendarThe Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST APICVE-2026-847452.7 Low
- themeum kirkiKirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDORCVE-2026-842252.2 Low
- themeum kirkiKirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field IDCVE-2026-842216.8 Medium
- boldthemes bold page builderBold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element AttributesCVE-2026-840226.8 Medium
- boldthemes bold page builderBold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URLCVE-2026-840216.8 Medium
- unknown greenshiftGreenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps AttributeCVE-2026-835446.8 Medium
- unknown greenshiftGreenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST EndpointCVE-2026-835434.1 Medium
- unknown masteriyo lmsMasteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom FieldsCVE-2026-828466.8 Medium
- codepeople music storeMusic Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data HandlerCVE-2026-823048.6 High
- unknown accept stripe paymentsAccept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDORCVE-2026-814245.3 Medium
- unknown accept stripe paymentsAccept Stripe Payments < 2.1.4 - Open Redirect via IPN HandlerCVE-2026-814234.3 Medium
- unknown ipgp visitors originIPGP Visitors Origin < 1.6 - Reflected XSSCVE-2026-814047.1 High
- unknown my private siteMy Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and SitemapCVE-2026-813483.7 Low
- lupsonline seo flow by lupsonlineSEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key AuthenticationCVE-2026-783629.8 Critical
- unknown smart postPost Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDORCVE-2026-781502.7 Low
- unknown smart postPost Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_password Disclosure via sp_handle_post_idCVE-2026-781495.3 Medium
- metagauss registrationmagicRegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience ValidationCVE-2026-778268.8 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification EmailsCVE-2026-198614.7 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic PresetCVE-2026-198587.5 High
- search atlas seo, unknown search atlas seo +1 moreSearch Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/DeletionCVE-2026-152475.4 Medium
- unknown joli table of contentsJoli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSSCVE-2025-156943.5 Low
- samuel marshall jch optimizeJCH Optimize 4.2.1 - 5.0.0 - Admin+ Path TraversalCVE-2025-156932.7 Low
- iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more, unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more +1 moreiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment ContentCVE-2026-772637.2 High
- iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more, unknown iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more +1 moreiubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex RewriteCVE-2026-772337.2 High
- magepeopleteam e-cab taxi booking manager for woocommerceE-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Unauthenticated Price Manipulation via mptbm_add_to_cartCVE-2026-840455.3 Medium
- unknown restaurant menu and food orderingRestaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPNCVE-2026-840445.3 Medium
- unknown epayco payment gateway for woocommerceePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation BypassCVE-2026-840435.3 Medium
- unknown ai website builder (github build)AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST RoutesCVE-2026-829239.8 Critical
- unknown xpro addons — 140+ widgets for elementor, xpro addons — 140+ widgets for elementor +1 moreXpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick ViewCVE-2026-841465.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_uploadCVE-2026-840663.1 Low
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.134 - Admin+ Arbitrary File Deletion via Path TraversalCVE-2026-821945.5 Medium
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path TraversalCVE-2026-821935.5 Medium
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' ParameterCVE-2026-821864.1 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.13 - Unauthenticated .htaccess and index.php Deletion via Custom Directory Path TraversalCVE-2026-813475.9 Medium
- unknown ninja formsNinja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST APICVE-2026-804385.9 Medium
- unknown wpfunnelsWPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submissionCVE-2026-796325.3 Medium
- unknown wpfunnelsWPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log FilesCVE-2026-796315.3 Medium
- unknown wpfunnelsWPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID SubstitutionCVE-2026-796305.3 Medium
- unknown podsPods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display CallbackCVE-2026-748536.8 Medium
- unknown hummingbird performanceHummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on MultisiteCVE-2026-192247.2 High
- unknown content viewsContent Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status FilterCVE-2026-175175.3 Medium
- radiustheme classified listingClassified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDORCVE-2026-162817.1 High
- unknown wpfunnelsWPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in FormsCVE-2025-156915.3 Medium
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerabilityCVE-2026-853095.3 Medium
- Show moreLoading…