Skip to contentUnknown vulnerabilities
Newest
- shahjada premium packagesPremium Packages < 7.2.1 - Unauthenticated PayPal Webhook Signature Verification BypassCVE-2026-935115.3 Medium
- unknown points and rewards for woocommercePoints and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_pointsCVE-2026-935104.3 Medium
- unknown wc fields factoryWC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAXCVE-2026-935088.1 High
- unknown wc fields factoryWC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content DisclosureCVE-2026-935073.3 Low
- magepeopleteam event booking manager for woocommerceEvent Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_listCVE-2026-910772.7 Low
- unknown subscribe formsSubscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form SettingCVE-2026-910736.8 Medium
- unknown booking managerBooking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDORCVE-2026-910254.3 Medium
- unknown booking managerBooking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)CVE-2026-910246.8 Medium
- unknown wpc smart compare for woocommerceWPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_loadCVE-2026-909855.3 Medium
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_paymentCVE-2026-909513.7 Low
- mahmudul hasan arif fluentboardsFluentBoards 1.95 - 2.0.15 - Unauthenticated Board Member Email Address Disclosure via Public Board EndpointsCVE-2026-893315.3 Medium
- js morisset jsm show post metadataJSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta KeyCVE-2026-88997Public exploit6.8 Medium
- unknown product badge, label, countdown timer for woocommerceSale Booster 7.0.0 - 7.5.1 - Unauthenticated Non-Public Product DisclosureCVE-2026-889295.3 Medium
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX ActionsCVE-2026-879814.7 Medium
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via WebhookCVE-2026-879795.3 Medium
- unknown forminator formsForminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled LinkCVE-2026-870743.7 Low
- unknown forminator formsForminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripeCVE-2026-870693.1 Low
- unknown real3d flipbookReal3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings OverwriteCVE-2026-868426.8 Medium
- unknown post grid gutenberg blocksPostX < 5.0.41 - Unauthenticated Custom Field Key Disclosure via REST APICVE-2026-867835.3 Medium
- brechtvds wp recipe makerWP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta InsertionCVE-2026-866088.2 High
- brechtvds wp recipe makerWP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_listsCVE-2026-866034.3 Medium
- brechtvds wp recipe makerWP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_previewCVE-2026-866024.3 Medium
- unknown happyaddons for elementorHappy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button WidgetCVE-2026-850066.8 Medium
- stellarwp the events calendarThe Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST RoutesCVE-2026-847433.8 Low
- stellarwp the events calendarThe Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST APICVE-2026-847422.7 Low
- stellarwp the events calendarThe Events Calendar 4.5 - 6.17.4.1 - Unauthenticated Non-Public Venue and Organizer Disclosure via REST APICVE-2026-847415.3 Medium
- arshid easy hide loginEasy Hide Login < 1.7 - Login Page Protection Bypass / Hidden URL DisclosureCVE-2026-841685.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites EndpointCVE-2026-841505.4 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listingCVE-2026-840986.5 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.9.5 - Subscriber+ SSRF via Avatar URLCVE-2026-840465.0 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders EndpointCVE-2026-840274.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users EndpointCVE-2026-840265.3 Medium
- icegram email subscribers & newslettersEmail Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token VerificationCVE-2026-835555.3 Medium
- unknown wp oauth server ( login with wordpress )WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token SubstitutionCVE-2026-828439.0 Critical
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDORCVE-2026-813394.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course DiscussionsCVE-2026-813384.6 Medium
- payment plugins for paypal woocommerce, unknown payment plugins for paypal woocommerce +1 morePayment Plugins for PayPal WooCommerce < 2.0.27 - Unauthenticated Payment Hijacking via Unvalidated PayPal Order IDCVE-2026-803426.5 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders EndpointCVE-2026-777664.3 Medium
- unknown better paymentBetter Payment < 2.3.4 - Unauthenticated Payment Amount ManipulationCVE-2026-777655.3 Medium
- unknown yahman add-onsYAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card CacheCVE-2026-757999.0 Critical
- unknown zportalsZportals < 6.4.2 - Subscriber+ User Email DisclosureCVE-2026-183654.3 Medium
- unknown zportalsZportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings UpdateCVE-2026-183644.3 Medium
- tribulant software newslettersNewsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDORCVE-2026-162646.5 Medium
- unknown divi-dashDivi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address SpoofingCVE-2026-143218.2 High
- unknown real3d flipbookReal3D Flipbook Lite < 5.4 - Author+ Stored XSSCVE-2025-156966.8 Medium
- unknown jet-form-builder-stripe-gatewayJetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Payment TokenCVE-2022-49978.6 High
- unknown social commerce for woocommerceSocial Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status UpdateCVE-2026-867855.3 Medium
- jgwhite33 wp yelp review sliderWP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)CVE-2026-937787.2 High
- unknown ninja formsNinja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV ExportCVE-2026-918277.5 High
- unknown ninja formsNinja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions AdminCVE-2026-924388.8 High
- Show moreLoading…