Skip to contentUnknown vulnerabilities
Newest
- unknown airwallex online payments gatewayAirwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass via Forged WebhookCVE-2026-1035175.3 Medium
- unknown track orders for woocommerceTrack Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' ParameterCVE-2026-942755.3 Medium
- unknown sms alertSMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User ActionsCVE-2026-942582.7 Low
- unknown wallet system for woocommerceWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDORCVE-2026-942466.3 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDORCVE-2026-942456.5 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via ExportCVE-2026-942444.3 Medium
- unknown backwpupBackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip FallbackCVE-2026-868286.6 Medium
- unknown backwpupBackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.phpCVE-2026-868275.3 Medium
- unknown backwpupBackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINXCVE-2026-868265.9 Medium
- unknown database addon for wpforms ( wpforms entries )Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRFCVE-2026-1052604.3 Medium
- unknown appointment booking pluginLatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDORCVE-2026-1051985.3 Medium
- unknown appointment booking pluginLatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDORCVE-2026-1051972.7 Low
- unknown appointment booking pluginLatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities APICVE-2026-1051963.3 Low
- unknown booking calendarBooking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option DisclosureCVE-2026-1051952.7 Low
- easy digital downloads digital downloads, unknown easy digital downloads +1 moreEasy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads BlockCVE-2026-1051944.3 Medium
- unknown booking calendarBooking Calendar < 11.8 - Unauthenticated Booking Information Disclosure and Modification via Predictable Booking HashCVE-2026-1051934.8 Medium
- unknown image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode AttributesCVE-2026-1046466.8 Medium
- unknown image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDORCVE-2026-1046452.7 Low
- m a vinoth kumar frontend dashboardFrontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function CallCVE-2026-1036929.8 Critical
- unknown ultimate multisiteUltimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' ParameterCVE-2026-1036469.8 Critical
- unknown gptranslateGPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation StorageCVE-2026-1033097.5 High
- 10web slider by 10webWordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerabilityCVE-2026-427107.6 High
- servit software solutions affiliate-toolkitWordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerabilityCVE-2026-427217.6 High
- unknown nexi xpay buildNexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification HandlerCVE-2026-822127.5 High
- unknown nexi xpay buildNexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key DisclosureCVE-2026-822118.2 High
- unknown magee shortcodesMagee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact FormCVE-2026-1053225.3 Medium
- unknown metformMetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field ShortcodesCVE-2026-868335.4 Medium
- blubrry powerpress podcasting plugin by blubrryPowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL RedirectsCVE-2026-973544.1 Medium
- unknown user private filesUser Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_accessCVE-2026-973314.3 Medium
- instawp string locatorString Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database EditorCVE-2026-971888.8 High
- optimoleOptimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetCVE-2026-965306.5 Medium
- unknown if-so dynamic contentIf-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' ParameterCVE-2026-879717.1 High
- unknown koinonia linkKoinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to AdministratorCVE-2026-877828.8 High
- arraytics wpcafeWPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST APICVE-2026-868165.3 Medium
- unknown magee shortcodesMagee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode ActionsCVE-2026-1053167.1 High
- themeisle mpgMPG < 4.2.3 - Editor+ SQLi via Project ImportCVE-2026-1049536.8 Medium
- codepeople cp media playerCP Media Player < 1.3.4 - Contributor+ Media Player Settings UpdateCVE-2026-1046782.7 Low
- unknown wp coderWP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHPCVE-2026-1046777.2 High
- sk. abul hasan animated number countersAnimated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter OrderCVE-2026-1046676.8 Medium
- unknown envira galleryEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop DimensionsCVE-2026-1046536.8 Medium
- unknown envira galleryEnvira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image IDCVE-2026-1046526.8 Medium
- unknown yaad sarig payment gateway for wcYaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDORCVE-2026-1046514.3 Medium
- kodezen llc academy lmsAcademy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answersCVE-2026-1040504.3 Medium
- kodezen llc academy lmsAcademy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST EndpointCVE-2026-1040494.3 Medium
- m a vinoth kumar frontend dashboardFrontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_deleteCVE-2026-1036814.3 Medium
- unknown geliver akıllı kargo pazaryeriGeliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log FileCVE-2026-1033786.5 Medium
- unknown integration for epos now and woocommerceIntegration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue DisclosureCVE-2026-1033235.9 Medium
- brewlabs sendpress newslettersWordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerabilityCVE-2026-397959.3 Critical
- shamim hasan front end pmWordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-397886.5 Medium
- 10web social photo feed, unknown 10web social photo feed +1 moreWordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerabilityCVE-2026-397876.5 Medium
- Show moreLoading…