Skip to contentUnknown vulnerabilities
Newest
- builderall for wordpress, unknown builderall for wordpress +1 moreBuilderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' SettingCVE-2026-157966.4 Medium
- unknown contact form 7 captchaContact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationCVE-2026-851176.5 Medium
- unknown wp express checkoutWP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_paymentCVE-2026-835375.3 Medium
- unknown hustleHustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message PlaceholdersCVE-2026-804404.8 Medium
- unknown cleantalkSpam protection, Honeypot, Anti-Spam by CleanTalk < 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment TextCVE-2026-198556.5 Medium
- unknown orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & moreOrbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table WidgetCVE-2026-854185.4 Medium
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX ActionsCVE-2026-851335.4 Medium
- unknown wplp cookie consentWPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scanCVE-2026-851324.3 Medium
- sunshinephotocart sunshine photo cartSunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDORCVE-2026-850375.3 Medium
- themeum kirkiKirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' ParameterCVE-2026-842225.3 Medium
- quentn.com gmbh quentn wpQuentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' ParameterCVE-2026-841134.1 Medium
- quentn.com gmbh quentn wpQuentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' ParameterCVE-2026-840688.6 High
- shaonsina sina extension for elementorSina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table WidgetCVE-2026-835416.8 Medium
- unknown masteriyo lmsMasteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment DisclosureCVE-2026-828485.3 Medium
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data ResetCVE-2026-821854.3 Medium
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option UpdateCVE-2026-821845.3 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg < 4.7.2 - Open Redirect via 'redirect_to' ParameterCVE-2026-817414.7 Medium
- psm plugins supportcandySupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code LeakCVE-2026-810225.3 Medium
- psm plugins supportcandySupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment DisclosureCVE-2026-810215.3 Medium
- payment plugins for paypal woocommerce, unknown payment plugins for paypal woocommerce +1 morePayment Plugins for PayPal WooCommerce < 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDORCVE-2026-803415.9 Medium
- payment plugins for paypal woocommerce, unknown payment plugins for paypal woocommerce +1 morePayment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-payCVE-2026-803405.3 Medium
- paymentplugins payment plugins for stripe woocommercePayment Plugins for Stripe WooCommerce < 4.0.12 - Unauthenticated Customer PII Disclosure via order-payCVE-2026-803395.3 Medium
- unknown ultimate gift cards for woocommerceUltimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized RedemptionCVE-2026-758616.5 Medium
- unknown wp travel, wp travel travel +1 moreWP Travel < 12.0.2 - Unauthenticated Arbitrary Booking CancellationCVE-2026-180425.3 Medium
- team tangible loops & logicLoops & Logic < 4.3.0 - Unauthenticated User Data and Site Option DisclosureCVE-2026-169607.5 High
- elextensions elex woocommerce request a quoteELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_idCVE-2026-149628.6 High
- unknown wp travel, wp travel travel +1 moreWP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDORCVE-2026-131463.7 Low
- unknown wp travel, wp travel travel +1 moreWP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment ResetCVE-2026-131443.7 Low
- alex content maskContent Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and StylesCVE-2025-156906.8 Medium
- themeum wp crowdfundingWP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' ParameterCVE-2026-199456.4 Medium
- themeum wp crowdfundingWP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post MetaCVE-2026-199444.9 Medium
- gm alex user access managerUser Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' ParameterCVE-2026-197976.1 Medium
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' ParameterCVE-2026-78046.1 Medium
- levelfourstorefront shopping cart & ecommerce storeShopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX ActionCVE-2026-175537.2 High
- unknown ninja formsNinja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge TagsCVE-2026-804374.8 Medium
- themeisle redirection for contact form 7Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-TagsCVE-2026-804394.8 Medium
- jetmonsters jetformbuilderJetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email ActionCVE-2026-198624.8 Medium
- jetmonsters jetformbuilderJetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' ParameterCVE-2026-198596.5 Medium
- unknown b2bking — ultimate woocommerce b2b and wholesale plugin — wholesale prices, bulk order form & moreB2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role SelectionCVE-2026-850385.3 Medium
- themeum kirkiKirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity DecodingCVE-2026-842197.5 High
- boldthemes bold page builderBold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settingsCVE-2026-840286.8 Medium
- surecartSureCart < 4.7.0 - Unauthenticated Account Creation with Automatic LoginCVE-2026-757936.5 Medium
- surecartSureCart < 4.6.3 - Subscriber+ Administrator Account TakeoverCVE-2026-184808.8 High
- unknown real estate papiReal Estate Papi <= 1.0.5 - Subscriber+ Plugin InstallationCVE-2026-131594.3 Medium
- bplugins video player for youtubeYT Player < 2.1.0 - Contributor+ SQLi via ytp_ajaxCVE-2026-849376.8 Medium
- unknown embedpressEmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database BloatCVE-2026-849365.3 Medium
- hasthemes ht menuHT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu SettingsCVE-2026-849358.0 High
- samuel marshall jch optimizeJCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task OverrideCVE-2026-849348.0 High
- unknown joli table of contentsJoli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme AttributeCVE-2026-849316.8 Medium
- unknown catfolders document gallery & pdf libraryCatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block AttributeCVE-2026-849306.8 Medium
- Show moreLoading…