Skip to contentUnknown vulnerabilities
Newest
- bookneticWordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerabilityCVE-2026-397469.3 Critical
- saravana kumar k wc fields factoryWordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-397276.5 Medium
- edgarrojas smart formsWordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-325747.1 High
- unknown file media renamerFile Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compatCVE-2026-942785.5 Medium
- unknown fast courierFast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST EndpointCVE-2026-892895.3 Medium
- bqworks slider proSlider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_imagesCVE-2026-867865.3 Medium
- unknown elegro crypto paymentelegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN CallbackCVE-2026-942996.5 Medium
- unknown deema payment gatewayDeema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success ReturnCVE-2026-942715.3 Medium
- unknown deema payment gatewayDeema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via WebhookCVE-2026-942705.3 Medium
- nikki blight qr redirectorWordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1050696.5 Medium
- unknown upi qr code payment gatewayUPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status ForgeryCVE-2026-841695.3 Medium
- imaginate solutions file uploads addon for woocommerceFile Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File DisclosureCVE-2026-783715.9 Medium
- imaginate solutions file uploads addon for woocommerceFile Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File AccessCVE-2026-136075.9 Medium
- unknown user private filesUser Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)CVE-2026-97332Public exploit5.3 Medium
- unknown cocartCoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication BypassCVE-2026-935498.8 High
- unknown five star business profile and schemaFive Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default CallbackCVE-2026-868174.9 Medium
- mra13 simple shopping cartSimple Shopping Cart < 5.2.6 - Admin+ Stored XSS via PayPal API CredentialsCVE-2026-1041193.5 Low
- razorpay for woocommerce, unknown razorpay for woocommerce +1 moreRazorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDORCVE-2026-1041185.3 Medium
- gopiplus horizontal scrolling announcementsHorizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style FieldCVE-2026-170056.8 Medium
- unknown twenty20 image before-afterTwenty20 Image Before-After <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode AttributeCVE-2026-927676.4 Medium
- genetech products pie registerPie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation CodeCVE-2026-969623.7 Low
- timwhitlock loco translateLoco Translate < 2.8.9 - Translator+ Stored XSS via Bundle ConfigurationCVE-2026-942396.8 Medium
- timwhitlock loco translateLoco Translate < 2.8.9 - Translator+ Limited File Read via 'path' ParameterCVE-2026-942386.8 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_dataCVE-2026-929236.3 Medium
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and DeletionCVE-2026-924375.3 Medium
- unknown tillkitTillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PINCVE-2026-910788.2 High
- unknown saveto wishlist liteSaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' ParametersCVE-2026-892368.6 High
- extendthemes kubio ai page builderKubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment ContentCVE-2026-887838.8 High
- extendthemes kubio ai page builderKubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL AttributeCVE-2026-887826.8 Medium
- unknown metformMetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms IntegrationCVE-2026-868343.7 Low
- unknown metformMetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST APICVE-2026-868325.3 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' ParameterCVE-2026-855686.8 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor < 2.0.21 - Authenticated Arbitrary File Write via Path TraversalCVE-2026-850156.6 Medium
- unknown wp ultimate csv importerWP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log PathCVE-2026-805183.7 Low
- unknown wp ultimate csv importerWP Ultimate CSV Importer 7.17 - 9.1 - Admin+ Stored XSS via ZIP Import SVG UploadCVE-2026-805173.5 Low
- unknown wp 2faWP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code ReplayCVE-2026-1035147.5 High
- themeisle mpgMPG < 4.2.3 - Editor+ Arbitrary File Read via Project ImportCVE-2026-1032936.8 Medium
- roxnor wp ultimate reviewWP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview SettingsCVE-2026-101162Public exploit6.4 Medium
- roxnor wp ultimate reviewWP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews ShortcodeCVE-2026-101161Public exploit7.5 High
- roxnor wp ultimate reviewWP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review RatingCVE-2026-101160Public exploit7.5 High
- roxnor wp ultimate reviewWP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review SubmissionCVE-2026-1011597.5 High
- unknown all in one seoAll in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search QueryCVE-2026-198566.5 Medium
- relevanssi premium, unknown relevanssi premium +1 moreRelevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' ParameterCVE-2026-1034267.2 High
- mstore api, unknown mstore api +1 moreMStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' ParameterCVE-2026-972194.3 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor < 2.0.21 - Subscriber+ Arbitrary Shortcode Execution via get_addon_output_dataCVE-2026-929245.4 Medium
- unknown webtoffee gift cards for woocommerceWebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amountCVE-2026-910205.3 Medium
- scottpaterson easy paypal & stripe buy now buttonEasy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied PriceCVE-2026-909875.3 Medium
- unknown wp edit password protectedWP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST APICVE-2026-909525.3 Medium
- popup maker wp, unknown popup maker wp +1 morePopup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing AuthorizationCVE-2026-850055.4 Medium
- stellarwp the events calendarThe Events Calendar 6.12.0 - 6.17.5 - Unauthenticated Arbitrary Shortcode Execution via 'view_data' ParameterCVE-2026-847406.5 Medium
- Show moreLoading…