Skip to contentUnknown vulnerabilities
Newest
- j0hnsmith testimonials widgetTestimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post UpdateCVE-2026-965327.5 High
- optimoleOptimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player BlockCVE-2026-965316.8 Medium
- unknown mcp server for wordpressMCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST RouteCVE-2026-965262.7 Low
- unknown mcp server for wordpressMCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership CheckCVE-2026-965252.7 Low
- unknown mcp server for wordpressMCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRFCVE-2026-965248.8 High
- unknown wp delicious, wp delicious delicious +1 moreWP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag NameCVE-2026-924116.8 Medium
- mndpsingh287 file manager, ninja team file manager pro, unknown fileorganizer +2 moreMultiple elFinder Plugins - DOM-based XSS via postMessage Origin BypassCVE-2026-850817.5 High
- unknown wp-review-slider-proWP Review Slider Pro < 12.7.12 - Subscriber+ SQLi via Stored Template FilterCVE-2026-840976.5 Medium
- unknown wp-review-slider-proWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form FieldsCVE-2026-840968.0 High
- unknown wp-review-slider-proWP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review ImportCVE-2026-840958.0 High
- mndpsingh287 file managerFile Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup DisclosureCVE-2026-197085.9 Medium
- hideoguchi bluff postBluff Post <= 1.1.1 - Unauthenticated SQLi via 'table_name' and 'column_name' ParametersCVE-2026-892376.8 Medium
- unknown wp directory kitWP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon FieldsCVE-2026-165917.2 High
- spwebguy team membersTeam Showcase Supreme < 9.3 - Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_detailsCVE-2026-118715.3 Medium
- stylemix masterstudy lmsMasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction BypassCVE-2026-888484.2 Medium
- tomdever wpforo forumwpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit BypassCVE-2026-805145.3 Medium
- booklyBookly < 28.3 - Unauthenticated Customer PII Update via Verification BypassCVE-2026-868375.3 Medium
- jetmonsters restaurant menu and food orderingRestaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' ParameterCVE-2026-965687.2 High
- unknown link libraryLink Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link ValidationCVE-2026-783974.0 Medium
- unknown link libraryLink Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' ParameterCVE-2026-783944.1 Medium
- unknown link libraryLink Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb LinksCVE-2026-783936.1 Medium
- pixelite events managerEvents Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' ParameterCVE-2026-936624.3 Medium
- pixelite events managerEvents Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDORCVE-2026-93661Public exploit2.7 Low
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to CategoryCVE-2026-890056.8 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDORCVE-2026-890042.7 Low
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item PreviewCVE-2026-890026.8 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record CreationCVE-2026-888474.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration DisabledCVE-2026-888465.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo ImportCVE-2026-888454.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories WidgetCVE-2026-888437.2 High
- radiustheme the post gridThe Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List WideningCVE-2026-841513.5 Low
- unknown masteriyo lmsMasteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key DisclosureCVE-2026-828504.3 Medium
- unknown masteriyo lmsMasteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDORCVE-2026-828494.3 Medium
- unknown 10web booster10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and DeletionCVE-2026-821956.5 Medium
- tomdever wpforo forumwpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile FieldsCVE-2026-805137.5 High
- jtsternberg cmb2CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed HandlerCVE-2026-803386.8 Medium
- syed balkhi wpformsWPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntentCVE-2026-749916.8 Medium
- kevin stover ninja formsWordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-955157.1 High
- secondlinethemes podcast importer secondlineWordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-946826.5 Medium
- payplus tech team payment gateway, unknown payplus payment gateway +1 moreWordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerabilityCVE-2026-936206.5 Medium
- unknown sumit payment gateway for woocommerceSUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPNCVE-2026-840915.3 Medium
- unknown paid membership subscriptionsPaid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Registration FormCVE-2026-909505.3 Medium
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.14 - Unauthenticated Payment Bypass via Unverified Subscription Transaction CallbackCVE-2026-879785.3 Medium
- unknown mpcx lightboxMPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content DisclosureCVE-2026-878483.7 Low
- unknown forminator formsForminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted PostsCVE-2026-870715.3 Medium
- unknown forminator formsForminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP SpoofingCVE-2026-870705.3 Medium
- shahjahan jewel ninja tablesNinja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data SourceCVE-2026-866125.6 Medium
- unknown gtranslateGTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email TranslationCVE-2026-866044.8 Medium
- brechtvds wp recipe makerWP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment ContentCVE-2026-866016.5 Medium
- gplsaver np quote request for woocommerceNP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request PageCVE-2026-93528Public exploit3.7 Low
- Show moreLoading…