Skip to contentUnknown vulnerabilities
Newest
- unknown clean loginClean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session ComparisonCVE-2026-909775.3 Medium
- unknown clean loginClean Login < 1.19 - Unauthenticated Account Creation with Registration DisabledCVE-2026-909765.3 Medium
- miles all bootstrap blocksAll Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block AttributesCVE-2026-889946.6 Medium
- john darrel hide my wp ghostWP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility CheckCVE-2026-868005.3 Medium
- john darrel hide my wp ghostWP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request ParametersCVE-2026-867965.3 Medium
- cloudways breeze cacheBreeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking ParametersCVE-2026-797136.5 Medium
- unknown generate pdf using contact form 7Generate PDF using Contact Form 7 < 4.2.2 - Unauthenticated Server-Side Request Forgery via Array-Valued Form FieldCVE-2026-909845.8 Medium
- unknown filter galleryFilter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce CheckCVE-2026-909787.1 High
- stellarwp bookit — booking & appointment calendarBookit < 2.6.0.5 - Bookit Staff+ Appointment PII DisclosureCVE-2026-890082.7 Low
- stellarwp bookit — booking & appointment calendarBookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing AuthorizationCVE-2026-890072.7 Low
- miles all bootstrap blocksAll Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type AttributeCVE-2026-889936.8 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDORCVE-2026-888442.7 Low
- igms direct booking, unknown igms direct booking +1 moreiGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget SettingsCVE-2026-888258.8 High
- unknown really simple securityReally Simple Security (Free) < 9.8.3 - Unauthenticated Unbounded Option Growth via Spoofed Client IP HeaderCVE-2026-887985.3 Medium
- easyappointments easy appointmentsEasy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDORCVE-2026-879665.3 Medium
- easyappointments easy appointmentsEasy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link TokenCVE-2026-879654.8 Medium
- unknown tz weekly radio scheduleTz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cellCVE-2026-877758.6 High
- unknown tz weekly radio scheduleTz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via weekCVE-2026-877748.6 High
- unknown product question and answerProduct Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and readCVE-2026-877718.6 High
- unknown price drop alert for woo commercePrice Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via productCVE-2026-877708.6 High
- unknown wp shortcut link and advertisement banerWP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via urlCVE-2026-877678.6 High
- flycart upsellwpUpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought TogetherCVE-2026-853505.3 Medium
- e4jvikwp vikbooking hotel booking engine & pmsVikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat AttachmentCVE-2026-851278.8 High
- unknown easy form builder by whitestudioEasy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Registration Policy Bypass via Login Form Type ConfusionCVE-2026-851235.3 Medium
- unknown easy form builder by whitestudioEasy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type ConfusionCVE-2026-851228.8 High
- magnigenie restropressRestroPress <= 3.4.6 - Unauthenticated Order Enumeration and Order Note Modification via Payment RecoveryCVE-2026-850096.5 Medium
- kingaddons.com king addons for elementorKing Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image OptimizerCVE-2026-849043.8 Low
- kingaddons.com king addons for elementorKing Addons for Elementor < 51.1.81 - Contributor+ Private Post Content Disclosure via kng_maintenance_page ShortcodeCVE-2026-849032.7 Low
- kingaddons.com king addons for elementorKing Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog ImportCVE-2026-849026.8 Medium
- unknown af companionAF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCECVE-2026-847389.1 Critical
- servmask all-in-one wp migration and backupAll-in-One WP Migration and Backup < 7.111 - Authenticated Privilege Escalation to Admin via Import Secret Key DisclosureCVE-2026-818107.2 High
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDORCVE-2026-813403.8 Low
- unknown fluentauthWordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerabilityCVE-2026-782965.3 Medium
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom FieldCVE-2026-878314.3 Medium
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID ReparentingCVE-2026-878294.3 Medium
- robokassa payment gateway for woocommerce, unknown robokassa payment gateway for woocommerce +1 moreRobokassa payment gateway for Woocommerce < 1.8.9 - Unauthenticated Payment Bypass via Forged JWT CallbackCVE-2026-910173.7 Low
- unknown yoYo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username ParameterCVE-2026-879638.6 High
- unknown to do list memberTo Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload HandlerCVE-2026-868018.8 High
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential DisclosureCVE-2026-910194.9 Medium
- stylemixthemes motorsMotors < 1.4.121 - Unauthenticated Draft/Private Listing DisclosureCVE-2026-910165.3 Medium
- liton arefin master addons for elementorMaster Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expiredCVE-2026-910155.3 Medium
- unknown realtyna organic idx plugin + wpl real estateRealtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector EndpointCVE-2026-910147.1 High
- exactly www ewww image optimizerEWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference ExpansionCVE-2026-910116.8 Medium
- matthiasnordwig invisible anti-spam & captcha — recaptcha alternative for all formsInvisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission DeletionCVE-2026-910104.3 Medium
- unknown active woot products tables for woocommerce. 100% freeActive Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachmentCVE-2026-910094.3 Medium
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce < 5.3.8 - Unauthenticated Attendee PII Disclosure via Booking Confirmation PanelCVE-2026-910083.7 Low
- unknown autopayAutopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and DeletionCVE-2026-909236.5 Medium
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.0.9 - Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency MismatchCVE-2026-909225.3 Medium
- unknown puppyfwPuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege EscalationCVE-2026-889048.8 High
- maennchen1.de wpshopgermany it-recht kanzleiwpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API TokenCVE-2026-887959.0 Critical
- Show moreLoading…