Skip to contentUnknown vulnerabilities
Newest
- unknown text stylerText Styler <= 1.1.1 - Contributor+ Stored XSSCVE-2026-887886.8 Medium
- easy payment payment gateway for paypal on woocommercePayment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment ConfusionCVE-2026-924005.3 Medium
- unknown to do list memberTo Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via ImportCVE-2026-868023.7 Low
- stellarwp givewpGiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor NameCVE-2026-851136.5 Medium
- magnigenie restropressRestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-onsCVE-2026-850105.3 Medium
- unknown web to print online designerWooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File UploadCVE-2026-821879.8 Critical
- tiktokbusinessplugin tiktokTikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code RedemptionCVE-2026-929653.7 Low
- carazo import and export users and customersImport and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend ImporterCVE-2026-925417.2 High
- carazo import and export users and customersImport and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_usersCVE-2026-925407.2 High
- jordy meow meow galleryMeow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_postsCVE-2026-924232.7 Low
- jordy meow meow galleryMeow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST RouteCVE-2026-924226.5 Medium
- fetch designs sign-up sheetsSign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRFCVE-2026-924104.3 Medium
- unknown tripzzyTripzzy < 1.5.1 - Unauthenticated Booking Data TamperingCVE-2026-878405.3 Medium
- unknown tripzzyTripzzy < 1.5.1 - Unauthenticated Arbitrary Comment DeletionCVE-2026-878397.5 High
- unknown forminator formsForminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form ImportCVE-2026-870686.6 Medium
- unknown forminator formsForminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object InjectionCVE-2026-870678.5 High
- unitecms unlimited elements for elementorUnlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object InjectionCVE-2026-850177.5 High
- themeum kirkiKirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG UploadCVE-2026-842236.8 Medium
- unknown saml single sign onSAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account MatchingCVE-2026-828428.1 High
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings UpdateCVE-2026-816543.1 Low
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDORCVE-2026-816534.2 Medium
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDORCVE-2026-816522.7 Low
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDORCVE-2026-816513.1 Low
- unknown photo gallery, sliders, proofing and themesNextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP ImportCVE-2026-816507.2 High
- carazo import and export users and customersImport and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatarCVE-2026-165424.1 Medium
- averta master sliderMaster Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode AttributesCVE-2026-148446.8 Medium
- unknown wordlift – ai powered seo – schema, wordlift – ai powered seo – schema +1 moreWordLift <= 3.54.10 - Unauthenticated Sensitive Information Exposure in JSON-LD REST API EndpointsCVE-2026-92895.3 Medium
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST APICVE-2026-924355.3 Medium
- linknacional rede itaú for woocommerce — payment pix, credit card and debitRede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX WebhookCVE-2026-924305.3 Medium
- themefic hydra booking — appointment scheduling & booking calendarHydra Booking < 1.2.4 - Hydra Host+ Cross-Host Account Modification and Deletion via IDORCVE-2026-924255.5 Medium
- themefic hydra booking — appointment scheduling & booking calendarHydra Booking 1.1.0 - < 1.2.3 - Hydra Host+ Host Profile Takeover via IDORCVE-2026-924214.7 Medium
- themefic hydra booking — appointment scheduling & booking calendarHydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDORCVE-2026-924203.8 Low
- unknown mgosyncMgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential DisclosureCVE-2026-924047.5 High
- unknown secure custom fieldsSecure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID SubstitutionCVE-2026-924033.7 Low
- unknown wpgraphql smart cacheWPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias SquattingCVE-2026-92099Public exploit6.5 Medium
- unknown online scheduling and appointment booking systemBookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDORCVE-2026-918474.8 Medium
- e4jvikwp vikrentitems flexible rental management systemVikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLiCVE-2026-889268.6 High
- unknown master blocksMaster Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label SettingsCVE-2026-888248.8 High
- stiofan userswpUsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider EmailCVE-2026-868148.1 High
- unknown botiga proBotiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST RouteCVE-2026-865919.8 Critical
- ultimate member member, unknown ultimate member +1 moreUltimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page TitleCVE-2026-856808.8 High
- unbounce landing pages, unknown unbounce landing pages +1 moreUnbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domainsCVE-2026-855748.0 High
- themefic ultra addons for contact form 7Ultimate Addons for Contact Form 7 3.2.4 - 3.5.50 - Unauthenticated Arbitrary File Upload via Signature FieldCVE-2026-847506.5 Medium
- unknown estatik real estate pluginEstatik < 4.3.5 - Reflected XSS via get_listings hash ParameterCVE-2026-767907.1 High
- unknown wp import export liteWP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User ImportCVE-2026-765547.2 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation CallbackCVE-2026-198605.5 Medium
- unknown business name generatorBusiness Name Generator <= 1.3 - Admin+ Stored XSS via Button Color SettingCVE-2025-156983.5 Low
- unknown nimble page builderNimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_pluginsCVE-2026-165574.3 Medium
- farazfrank filter galleryFilter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX ActionCVE-2026-891384.3 Medium
- farazfrank filter galleryFilter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' ParameterCVE-2026-894138.1 High
- Show moreLoading…