Skip to contentUnknown vulnerabilities
Newest
- unknown dictionaryDictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary UpdateCVE-2026-887928.8 High
- unknown comments import & exportComments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via ExportCVE-2026-878362.7 Low
- unknown dewa kirimDewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout CoordinatesCVE-2026-877868.8 High
- stefano lissa newsletterNewsletter < 9.3.8 - Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature KeyCVE-2026-868244.8 Medium
- unknown ht mega addons for elementorHT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline TagCVE-2026-867886.8 Medium
- unknown login with qrLogin with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' ParameterCVE-2026-867109.8 Critical
- unknown the pressengineThe Pressengine <= 1.0 - Unauthenticated Authentication BypassCVE-2026-867099.8 Critical
- unknown private feed keyPrivate Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' ParameterCVE-2026-867079.8 Critical
- thimpress learnpressLearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST EndpointCVE-2026-864463.7 Low
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent LogsCVE-2026-851308.8 High
- unknown choose user role at registrationChoose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role RequestCVE-2026-851287.5 High
- unknown dictionaryDictionary <= 1.0 - Reflected XSS via Multiple ParametersCVE-2025-156977.1 High
- codepeople appointment hour bookingAppointment Hour Booking < 1.5.95 - Unauthenticated Booking Capacity Bypass via Multi-Appointment SubmissionCVE-2026-864755.3 Medium
- arraytics eventinEventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction ReplayCVE-2026-849065.3 Medium
- unknown formidable formsFormidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML TokenCVE-2026-198574.8 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification EmailsCVE-2026-134076.1 Medium
- mahmudul hasan arif fluentboardsFluentBoards < 2.0.15 - Board Member+ Board Membership and Public Access ModificationCVE-2026-893283.8 Low
- mahmudul hasan arif fluentboardsFluentBoards < 2.0.15 - Board Member+ Comment Author Spoofing via 'comment_by' ParameterCVE-2026-893273.8 Low
- unknown kboardKBoard < 6.7 - Unauthenticated Board Media Deletion via IDORCVE-2026-889105.3 Medium
- unknown wpbotWPBot 8.7.2 - 8.7.5 - Subscriber+ Claude AI Settings UpdateCVE-2026-879595.4 Medium
- unknown rox appointment bookingRox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST RoutesCVE-2026-879075.3 Medium
- unknown rox appointment bookingRox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST RouteCVE-2026-878965.3 Medium
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRFCVE-2026-878604.3 Medium
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key BypassCVE-2026-878545.3 Medium
- seraphinitesoft seraphinite acceleratorSeraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State UpdateCVE-2026-878285.7 Medium
- stefano lissa newsletterNewsletter < 9.3.7 - Unauthenticated Open Redirect and Subscriber Token Disclosure via ncu ParameterCVE-2026-868235.3 Medium
- themeisle visualizerVisualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data SourceCVE-2026-867846.8 Medium
- thimpress learnpressLearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST APICVE-2026-864495.3 Medium
- thimpress learnpressLearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_orderCVE-2026-864483.7 Low
- thimpress learnpressLearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajaxCVE-2026-864475.3 Medium
- thimpress learnpressLearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajaxCVE-2026-864455.3 Medium
- thimpress learnpressLearnPress < 4.4.7 - Reflected XSS via 'skin' ParameterCVE-2026-864447.1 High
- unknown formidable formsFormidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' ParameterCVE-2026-856414.3 Medium
- themeum tutor lmsTutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment DisclosureCVE-2026-855724.3 Medium
- themeum tutor lmsTutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request MisclassificationCVE-2026-855697.2 High
- stellarwp givewpGiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization MismatchCVE-2026-855308.1 High
- mahmudul hasan arif fluentboardsFluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDORCVE-2026-853494.3 Medium
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.4 - Arbitrary Post Deletion via CSRFCVE-2026-851316.5 Medium
- arraytics eventinEventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST EndpointCVE-2026-849073.7 Low
- arraytics eventinEventin < 4.1.24 - Contributor+ User Creation via Speaker CreationCVE-2026-849052.7 Low
- optimoleOptimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor ParameterCVE-2026-848298.8 High
- unknown xpro addons — 140+ widgets for elementor, xpro addons — 140+ widgets for elementor +1 moreXpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle WidgetCVE-2026-840886.8 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema GenerationCVE-2026-821262.7 Low
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDORCVE-2026-821255.3 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema OutputCVE-2026-821245.3 Medium
- anzia ni woocommerce sales reportNi WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' ParameterCVE-2026-784745.3 Medium
- anzia ni woocommerce sales reportNi WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' ParameterCVE-2026-784728.6 High
- arraytics eventinEventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_tokenCVE-2026-777025.3 Medium
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Admin+ SSRF via Import URL HandlingCVE-2026-765594.1 Medium
- unknown wp import export liteWP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field NamesCVE-2026-765586.8 Medium
- Show moreLoading…