Skip to contentUnknown vulnerabilities
Newest
- unknown memberheroSimple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_userCVE-2026-942354.3 Medium
- saad iqbal post snippetsPost Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet VariableCVE-2026-129806.8 Medium
- unknown anton extensionsAnton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCECVE-2026-1040289.8 Critical
- mobile builder builder, unknown mobile builder +1 moreMobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' ParameterCVE-2026-1036958.6 High
- mobile builder builder, unknown mobile builder +1 moreMobile builder <= 1.4.2 - Subscriber+ Privilege Escalation to AdminCVE-2026-1036948.8 High
- scimone ignazio prenotazioniPrenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings UpdateCVE-2026-1033058.8 High
- bplugins document embedderWordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-620377.1 High
- smackcoders inc. wp ultimate csv importerWordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerabilityCVE-2026-454407.6 High
- 10web slider by 10webWordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-427117.1 High
- 10web slider by 10webWordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerabilityCVE-2026-1058858.8 High
- dfactory responsive lightbox & galleryResponsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' AttributeCVE-2026-1038974.4 Medium
- unknown sms alertSMS Alert 3.9.6 - 4.0.2 - Unauthenticated Privilege Escalation via Arbitrary Password ResetCVE-2026-942578.1 High
- unknown sms alertSMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTPCVE-2026-942568.1 High
- unknown ltl freight quotesLTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' ParameterCVE-2026-877818.6 High
- unknown ltl freight quotesLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping RulesCVE-2026-877808.8 High
- themeum tutor lmsTutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDORCVE-2026-855716.5 Medium
- unknown gallery photoblocksGallery PhotoBlocks 1.3.5 - Contributor+ Stored XSSCVE-2026-1073236.8 Medium
- boldgrid w3 total cacheW3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library ImportCVE-2026-1073215.4 Medium
- unknown contest galleryContest Gallery < 33.0.1 - Unauthenticated Email Verification Bypass via Brute-Forceable Registration PINCVE-2026-1071205.3 Medium
- masaakitanaka booking packageBooking Package < 1.7.30 - Unauthenticated Booking Customer PII DisclosureCVE-2026-1059955.3 Medium
- unknown accept paypal payments using contact form 7Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV ExportCVE-2026-1059905.3 Medium
- unknown accept paypal payments using contact form 7Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status ForgeryCVE-2026-1059895.3 Medium
- awordpresslife portfolio filter galleryPortfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnailCVE-2026-1059772.2 Low
- awordpresslife portfolio filter galleryPortfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX ActionsCVE-2026-1059764.7 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URLCVE-2026-1047543.5 Low
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' ParameterCVE-2026-1047534.1 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings ImportCVE-2026-1047527.2 High
- syed balkhi envira galleryEnvira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST EndpointCVE-2026-1040795.3 Medium
- unknown livees checkoutLivees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key DisclosureCVE-2026-868516.5 Medium
- unknown super paymentsSuper Payments < 1.43.1 - Unauthenticated Payment Confirmation Forgery via Webhook SignatureCVE-2026-1033295.3 Medium
- morkva shipping for nova poshtaShipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record DeletionCVE-2026-878465.3 Medium
- unknown testimonials by bestwebsoftTestimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' ParameterCVE-2026-892356.8 Medium
- audrasjb gdpr data request formGDPR Data Request Form 1.5 - 1.7.1 - DPO Email Update via CSRFCVE-2026-853484.3 Medium
- unknown generate pdf using contact form 7WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerabilityCVE-2026-946667.5 High
- unknown ajax search proWordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerabilityCVE-2026-963319.3 Critical
- themeum kirkiKirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URLCVE-2026-842244.1 Medium
- themeum kirkiKirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments CollectionCVE-2026-842204.8 Medium
- unknown foosalesFooSales < 1.43.3 - Subscriber+ Privilege Escalation via User ImpersonationCVE-2026-935488.8 High
- codesnippetspro code snippetsCode Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)CVE-2026-1060976.8 Medium
- unitech web unitechpayUnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned WebhookCVE-2026-878415.3 Medium
- codesnippetspro code snippetsCode Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippetCVE-2026-1060953.3 Low
- strategy11team awp classifiedsAWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP ImportCVE-2025-157008.8 High
- unknown sendpress newslettersSendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded TokenCVE-2026-929905.3 Medium
- unknown sendpress newslettersSendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter QueueingCVE-2026-929894.3 Medium
- unknown social web suiteSocial Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings UpdateCVE-2026-889315.3 Medium
- unknown sku error fixer for woocommerceSKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation DeletionCVE-2026-868506.5 Medium
- melapress wp 2faWordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2026-621428.8 High
- unknown wallet system for woocommerceWallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer AmountCVE-2026-935096.5 Medium
- easy digital downloads digital downloads, unknown easy digital downloads +1 moreEasy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration DisabledCVE-2026-1051905.3 Medium
- unknown tutorstarterTutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAXCVE-2026-1046715.3 Medium
- Show moreLoading…