Skip to contentUnknown vulnerabilities
Newest
- keywordrush content eggContent Egg < 11.9.0 - Contributor+ Stored XSS via Import QueueCVE-2026-92424Public exploit6.8 Medium
- freshlight lab wp mobile menuWP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRFCVE-2026-918327.1 High
- exactly www ewww image optimizerEWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration HandlerCVE-2026-910724.4 Medium
- exactly www ewww image optimizerEWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post MetaCVE-2026-910516.6 Medium
- unknown image optimizerImage Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission CallbacksCVE-2026-909534.3 Medium
- creative motion robin image optimizerRobin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML ParserCVE-2026-891937.5 High
- creative motion robin image optimizerRobin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajaxCVE-2026-891904.3 Medium
- unknown vayu xVayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and ActivationCVE-2026-887977.1 High
- unknown safe redirect managerSafe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect RulesCVE-2026-887913.4 Low
- unknown hostinger reachHostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget AttributeCVE-2026-877776.8 Medium
- shazahm1hotmailcom connections business directoryConnections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST RoutesCVE-2026-867895.3 Medium
- unknown all in one files uploadAll in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings UpdateCVE-2026-855764.3 Medium
- unknown all in one files uploadAll in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG UploadCVE-2026-855738.8 High
- unknown audio player blockAudio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URLCVE-2026-854156.8 Medium
- unknown embedpressEmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle AttributeCVE-2026-850016.8 Medium
- saad iqbal new user approveNew User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key BypassCVE-2026-835605.3 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term FieldsCVE-2026-821273.5 Low
- solacewp solace extraSolace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview RoutesCVE-2026-803335.3 Medium
- unknown zella themeZella Theme < 2.6.3 - Unauthenticated Arbitrary File UploadCVE-2026-758739.8 Critical
- unknown user frontendWP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration DisabledCVE-2026-758245.3 Medium
- unknown user frontendWP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role EncryptionCVE-2026-758237.4 High
- unknown fluentcart a new era of ecommerceFluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout EmailCVE-2026-1001436.5 Medium
- soft8soft llc verge3d publishing and e-commerceVerge3D 4.1.0 - 4.13.0 - Unauthenticated Payment Bypass via v3d_payment_doneCVE-2026-929965.3 Medium
- unknown paymatticPaymattic < 4.6.26 - Unauthenticated Payment Bypass via Unbound Stripe PaymentIntentCVE-2026-894115.3 Medium
- unknown blacklist managerBlacklist Manager for WooCommerce 1.3.0 - 2.3.1 - Blocked User Restriction Bypass via XML-RPC and Application PasswordsCVE-2026-888285.4 Medium
- booklyBookly < 28.3 - Unauthenticated Payment Bypass via Booking Price ManipulationCVE-2026-868385.3 Medium
- syed balkhi wpformsWPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field RepopulationCVE-2026-847446.5 Medium
- unknown sps-suiteSPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via SearchCVE-2026-930006.8 Medium
- unknown wp verify apiWP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary RecipientsCVE-2026-893005.3 Medium
- unknown post voting systemPost Voting System <= 1.0 - Subscriber+ SQLi via 'row' ParameterCVE-2026-893036.4 Medium
- blubrry powerpress podcasting plugin by blubrryPowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player BlockCVE-2026-973196.8 Medium
- nextscripts nextscripts: social networks auto-posterNextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data DeletionCVE-2026-972275.9 Medium
- ihomefinder optima express idxOptima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_scriptCVE-2026-968996.8 Medium
- ihomefinder optima express idxOptima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cacheCVE-2026-968975.3 Medium
- malcure malware shield — removal, repair, monitor, unknown malcure malware shield — removal, repair, monitor +1 moreMalcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_requestCVE-2026-968967.2 High
- futtta wp youtube lyteWP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block AttributesCVE-2026-968956.8 Medium
- soft8soft llc verge3d publishing and e-commerceVerge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_fileCVE-2026-929955.3 Medium
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDORCVE-2026-924365.3 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed ImportCVE-2026-890066.8 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign PreviewCVE-2026-890034.1 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign SettingsCVE-2026-890014.9 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign RunCVE-2026-890004.1 Medium
- unknown online scheduling and appointment booking systemBookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced OptionsCVE-2026-868414.7 Medium
- unknown online scheduling and appointment booking systemBookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDORCVE-2026-868393.8 Low
- codename065 download managerDownload Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock SubscriptionCVE-2026-866098.8 High
- unknown embedpressEmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block AttributesCVE-2026-850026.8 Medium
- unknown webfacing™WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.phpCVE-2026-840695.3 Medium
- davidanderson updraftplus: wp backup & migration pluginUpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration NoticeCVE-2026-828415.3 Medium
- ad inserter inserter, unknown ad inserter +1 moreAd Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom FieldsCVE-2026-816557.5 High
- j0hnsmith testimonials widgetTestimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URLCVE-2026-965335.8 Medium
- Show moreLoading…