Skip to contentUnknown vulnerabilities
Newest
- unknown wp user frontendWP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated FormCVE-2026-796184.3 Medium
- smub wp mail loggingWP Mail Logging < 1.17.0 - Unauthenticated HTML InjectionCVE-2026-16614.3 Medium
- niteothemes cmp – coming soon & maintenanceCMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL MatchCVE-2026-134135.3 Medium
- syed balkhi giveaways and contests by rafflepressGiveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' ParameterCVE-2026-973186.1 Medium
- syed balkhi giveaways and contests by rafflepressGiveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway PageCVE-2026-973175.3 Medium
- moby buildkitBuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content ParameterCVE-2026-942986.2 Medium
- daanvandenbergh omgf | gdpr/dsgvo compliant, faster google fonts. easy.OMGF < 6.3.11 - Unauthenticated DoS via do_optimizeCVE-2026-918287.5 High
- stylemixthemes motorsMotors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featuredCVE-2026-910233.1 Low
- stylemixthemes motorsMotors < 1.4.124 - Listing Manager+ Stored XSS via Badge ColorCVE-2026-910226.8 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library ParameterCVE-2026-850166.8 Medium
- emarket-design request a quoteRequest a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenumCVE-2026-909885.3 Medium
- popup maker maker, unknown popup maker +1 morePopup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connectCVE-2026-850044.3 Medium
- paytm payment gateway, unknown paytm payment gateway +1 morePaytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment CallbackCVE-2026-817405.3 Medium
- unknown tabs responsiveTabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab ContentCVE-2026-137186.8 Medium
- pete nelson rest api logWordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-1005147.5 High
- nickboss wordpress file uploadWordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerabilityCVE-2026-620719.3 Critical
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerabilityCVE-2026-1033405.3 Medium
- smackcoders inc. wp ultimate csv importerWordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerabilityCVE-2026-1033365.3 Medium
- inisev social media share buttons & social sharing iconsSocial Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URLCVE-2026-890476.1 Medium
- unknown payments for hubtelPayments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug LogCVE-2026-962557.5 High
- unknown payments for hubtelPayments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment CallbackCVE-2026-962005.3 Medium
- unknown payments for hubtelPayments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDORCVE-2026-961735.3 Medium
- five star plugins star restaurant reviews, unknown five star restaurant reviews +1 moreFive Star Restaurant Reviews < 2.3.14 - Reflected XSSCVE-2026-924127.1 High
- unknown wp fusion liteWP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings UpdateCVE-2026-909746.5 Medium
- unknown wp fusion liteWP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data DeletionCVE-2026-909725.4 Medium
- unknown pro like buttonPro Like Button < 2.0 - Unauthenticated SQLi via 'postid' ParameterCVE-2026-892968.6 High
- unknown if-so dynamic contentIf-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion NameCVE-2026-879733.1 Low
- unknown if-so dynamic contentIf-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodesCVE-2026-879704.7 Medium
- codename065 download managerDownload Manager < 3.3.71 - Author+ Stored XSS via Package IconCVE-2026-866106.4 Medium
- paytm payment gateway, unknown paytm payment gateway +1 morePaytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment CallbackCVE-2026-818097.5 High
- paytm payment gateway, unknown paytm payment gateway +1 morePaytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment CallbackCVE-2026-817397.5 High
- unknown cache enablerCache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_urlCVE-2026-192538.7 High
- unknown backupsheep wordpress backup pluginBackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration KeyCVE-2026-10114810.0 Critical
- marceljm featured image from url (fifu), unknown featured image from url (fifu) premium +1 moreFeatured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRFCVE-2026-1011478.8 High
- hook & filter nested pagesWordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerabilityCVE-2026-1005129.8 Critical
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerabilityCVE-2026-1023976.5 Medium
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1023967.1 High
- kevin stover ninja formsWordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1023857.1 High
- if-so dynamic content personalization, unknown if-so dynamic content personalization +1 moreWordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1005077.1 High
- happyformsWordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-970657.1 High
- unknown yith woocommerce ajax searchWordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-963527.1 High
- 10up safe svgWordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-946724.3 Medium
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-940787.1 High
- 10up safe svgWordPress Safe SVG plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-940776.5 Medium
- apos37 broken link notifierBroken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect BypassCVE-2026-973165.8 Medium
- unknown course booking systemCourse Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV ExportCVE-2026-968865.3 Medium
- unknown media library organizerMedia Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term CreationCVE-2026-942972.7 Low
- unknown yayreviewsYayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST APICVE-2026-942745.3 Medium
- inspirelabs inpost plInPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment WebhookCVE-2026-935805.3 Medium
- soft8soft llc verge3d publishing and e-commerceVerge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage APICVE-2026-929948.8 High
- Show moreLoading…