Skip to contentUnknown vulnerabilities
Newest
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated SQLi via Import OptionsCVE-2026-765576.8 Medium
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter RulesCVE-2026-765566.8 Medium
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path TraversalCVE-2026-76555Public exploit6.8 Medium
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path TraversalCVE-2026-765536.5 Medium
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image ImportCVE-2026-765528.8 High
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP FunctionCVE-2026-765517.2 High
- unknown wp import export liteWP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path TraversalCVE-2026-765507.2 High
- multivendorxMultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST EndpointCVE-2026-749267.1 High
- blueglassch job postingsJob Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' ParameterCVE-2026-180636.4 Medium
- unknown wp directory kitWP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindowCVE-2026-182325.3 Medium
- unknown wp directory kitWP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget SettingsCVE-2026-165936.8 Medium
- unknown wp directory kitWP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via ShortcodesCVE-2026-165922.7 Low
- reallysimpleplugins really simple securityReally Simple Security < 9.8.2 Authorization Bypass via profile-page update handlerCVE-2026-825192.3 Low
- unknown quads ads manager for google adsenseQuads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URLCVE-2026-890504.3 Medium
- mdjm event management, unknown mdjm event management, mobile events manager +2 moreMDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post DeletionCVE-2026-888027.5 High
- embeds for youtube plugin support youtube embedYouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_serverCVE-2026-887938.8 High
- unknown hoo companionHoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings ImportCVE-2026-851298.8 High
- unknown cryptopayment gatewayCryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX RouterCVE-2026-81648Public exploit10.0 Critical
- unknown geniewordsGenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration OverwriteCVE-2026-749338.8 High
- unknown really simple securityReally Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State DemotionCVE-2026-890807.5 High
- stellarwp bookit — booking & appointment calendarBookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability CheckCVE-2026-889955.3 Medium
- rtcamp rtmedia for wordpress, buddypress and bbpressrtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDORCVE-2026-889124.2 Medium
- unknown simple membershipSimple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_refCVE-2026-887645.4 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You PageCVE-2026-864073.7 Low
- unknown user registration & membershipUser Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership PurchaseCVE-2026-864067.5 High
- unknown user registration & membershipUser Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect ParametersCVE-2026-800724.7 Medium
- unknown user registration & membershipUser Registration & Membership < 5.2.8 - Author+ Privilege Escalation to AdministratorCVE-2026-800717.2 High
- unknown contact form to chat apps | click to chat to orderSocial Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entryCVE-2026-777735.3 Medium
- ninjew geo my wpGEO my WP <= 4.5.5.3 - Unauthenticated Local File InclusionCVE-2026-852007.5 High
- unknown product xml feed manager for woocommerceProduct XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via ShortcodeCVE-2026-879194.9 Medium
- unknown wpbotWPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX ActionsCVE-2026-879185.3 Medium
- unknown wpbotWPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII DisclosureCVE-2026-879165.3 Medium
- unknown rox appointment bookingRox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDORCVE-2026-878945.3 Medium
- unknown rox appointment bookingRox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction BypassCVE-2026-878925.3 Medium
- unknown rox appointment bookingRox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST APICVE-2026-878916.5 Medium
- unknown yaypricingYayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST RouteCVE-2026-878888.0 High
- unknown zonifyZonify < 1.0.5 - Unauthenticated Account Login Token DisclosureCVE-2026-878427.5 High
- unknown sprout invoicesClient Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_noteCVE-2026-877974.3 Medium
- unknown add user autocompleteAdd User Autocomplete < 1.2 - Subscriber+ Privilege EscalationCVE-2026-877598.8 High
- unknown wp highlight boxWP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box ShortcodeCVE-2026-867906.8 Medium
- unknown wp componentWP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option UpdateCVE-2026-856819.8 Critical
- unknown wp images upload on piclectWP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File UploadCVE-2026-841719.8 Critical
- unknown wpstorecartIDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.phpCVE-2026-840998.1 High
- unknown album cover finderAlbum Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_actionCVE-2026-840478.6 High
- realmag777 bearBEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDORCVE-2026-840252.2 Low
- realmag777 bearBEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRFCVE-2026-840244.3 Medium
- realmag777 bearBEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRFCVE-2026-840236.5 Medium
- unknown masteriyo lmsMasteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDORCVE-2026-828512.7 Low
- unknown masteriyo lmsMasteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course HighlightsCVE-2026-828476.8 Medium
- unknown masteriyo lmsMasteriyo LMS < 3.4.1 - Subscriber+ PHP Object InjectionCVE-2026-828459.9 Critical
- Show moreLoading…