Skip to contentUnknown vulnerabilities
Newest
- unknown be rest endpointsBE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget ManipulationCVE-2026-817428.8 High
- unknown export & import wpbakery page builderExport & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRFCVE-2026-814297.1 High
- unknown ds ad rotatorDS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File UploadCVE-2026-814029.8 Critical
- unknown gpx2graphicsGpx2Graphics <= 0.3 - Arbitrary File Upload via CSRFCVE-2026-810907.2 High
- unknown yogeta wp cloudYogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File DownloadCVE-2026-804948.6 High
- unknown samo formsSAMO Forms <= 1.0.0 - Unauthenticated SQLiCVE-2026-804918.6 High
- unknown surerank seoSureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person SchemaCVE-2026-781525.3 Medium
- unknown temporary login without passwordTemporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application PasswordsCVE-2026-777535.5 Medium
- unknown temporary login without passwordTemporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege EscalationCVE-2026-777527.2 High
- unknown booking for appointments and events calendarAmelia < 2.4.10 - Amelia Manager+ WordPress Account TakeoverCVE-2026-777057.2 High
- unknown booking for appointments and events calendarAmelia Pro 9.0 - 9.8 - Unauthenticated Payment BypassCVE-2026-776895.3 Medium
- unknown webtotem backupsWebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path TraversalCVE-2026-770069.6 Critical
- unknown code monkeys proposalsCode Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path TraversalCVE-2026-770059.6 Critical
- unknown frontegg saml ssoFrontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponseCVE-2026-758009.8 Critical
- unknown custom menu wizard widgetCustom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode AttributesCVE-2026-835326.8 Medium
- unknown metformMetForm < 4.1.9 - Unauthenticated Email Header Injection via Notification Reply-ToCVE-2026-868134.8 Medium
- unknown persian elementorPersian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority BypassCVE-2026-868095.3 Medium
- unknown simple captcha with cloudflare turnstileSimple CAPTCHA with Cloudflare Turnstile 1.2.2 - 1.42.1 - Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field RepopulationCVE-2026-851166.5 Medium
- unknown payment gateway paypay for woocommerceWC PayPay Gateway 0.5 - 0.9.3 - Unauthenticated Payment Bypass via Unverified WebhookCVE-2026-822155.9 Medium
- unknown nexi xpay buildNexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDORCVE-2026-822135.3 Medium
- unknown backwpupBackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST RoutesCVE-2026-868155.5 Medium
- arraytics wpcafeWPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST APICVE-2026-868126.5 Medium
- themeisle visualizerVisualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDORCVE-2026-867825.5 Medium
- sslzen ssl zen — ssl certificate installer & https redirectsSSL Zen < 4.7.40 - Subscriber+ TLS Private Key DisclosureCVE-2026-867815.3 Medium
- unknown featured image with urlFeatured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt TextCVE-2026-867806.8 Medium
- themeisle visualizerVisualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChartCVE-2026-867792.7 Low
- unknown ai builderAI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScriptCVE-2026-856786.8 Medium
- unknown gutenverse newsGutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment ContentCVE-2026-856778.8 High
- unknown yith woocommerce wishlist, yith woocommerce wishlist +1 moreYITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_titleCVE-2026-823055.3 Medium
- multivendorxMultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to AdministratorCVE-2026-749257.2 High
- unknown advanced-customized-promptsAdvanced Customized Prompts <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata TamperingCVE-2026-145664.3 Medium
- unknown advanced-customized-promptsAdvanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup ConfigurationCVE-2026-145655.4 Medium
- unknown coolclockCoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class AttributeCVE-2026-835466.8 Medium
- unknown advanced-customized-promptsAdvanced Customized Prompts <= 1.0.1 - Unauthenticated Account TakeoverCVE-2026-145639.8 Critical
- unknown teddy-bear-customize-addonTeddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data DisclosureCVE-2026-145625.3 Medium
- unknown teddy-bear-customize-addonTeddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File UploadCVE-2026-1456010.0 Critical
- unknown teddy-bear-customize-addonTeddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account TakeoverCVE-2026-145599.8 Critical
- unknown translate wordpress with gtranslateGTranslate < 3.0.10 - Admin+ Stored XSSCVE-2025-156953.5 Low
- unknown coolclockCoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSONCVE-2026-835456.8 Medium
- themifyme themify – woocommerce product filterThemify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site ScriptingCVE-2026-781726.1 Medium
- unknown site reviewsSite Reviews 7.2.2 - 8.2.2 - Unauthenticated PHP Object Injection via Form SignatureCVE-2026-829258.1 High
- themegrill registration form for woocommerceRegistration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_idCVE-2026-814317.2 High
- unknown zipmoney(zip co) payments plugin for woocommercezipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option DeletionCVE-2026-783619.1 Critical
- unknown miniorange 2faminiOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP LockoutCVE-2026-77771Public exploit7.5 High
- unknown miniorange 2faminiOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link ValidatorCVE-2026-77770Public exploit10.0 Critical
- unknown notiqooNotiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX ActionsCVE-2026-198406.5 Medium
- unknown ultimate gift cards for woocommerceUltimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_detailsCVE-2026-194397.5 High
- unknown ultimate gift cards for woocommerceUltimate Gift Cards For WooCommerce < 3.2.10 - Unauthenticated Gift Card Value Inflation via Discounted PurchaseCVE-2026-194367.5 High
- builderall for wordpress, unknown builderall for wordpress +1 moreBuilderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' SettingCVE-2026-158206.4 Medium
- builderall for wordpress, unknown builderall for wordpress +1 moreBuilderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' ParameterCVE-2026-158234.3 Medium
- Show moreLoading…