Skip to contentUnknown vulnerabilities
Newest
- tainacanTainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST EndpointsCVE-2026-909894.3 Medium
- unknown fast courierFast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' ParameterCVE-2026-892888.6 High
- rtcamp rtmedia for wordpress, buddypress and bbpressrtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDORCVE-2026-889274.3 Medium
- unknown asaas gateway for woocommerceAsaas Gateway for WooCommerce < 2.7.8 - Unauthenticated Order Payment Bypass via WebhookCVE-2026-879745.3 Medium
- unknown product feed for google shopping, microsoft advertising and 40+ channels for woocommerce merchantProduct Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store RegistrationCVE-2026-879685.3 Medium
- trust payments gateway for woocommerce, unknown trust payments gateway for woocommerce +1 moreTrust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return PageCVE-2026-878436.5 Medium
- made i.t. formsForms < 3.0.2 - Unauthenticated Stored XSS via Form SubmissionCVE-2026-867998.8 High
- supsystic pricing tablePricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing LinkCVE-2026-867976.8 Medium
- unknown affiliate-toolkitAffiliate Toolkit 3.8.7 - 3.9.0 - Contributor+ RCE via BladeOne @php DirectiveCVE-2026-867877.2 High
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Player 7.5.44.7212 - 7.5.54.7212 - Contributor+ SSRF via retrieve_video_dataCVE-2026-853454.1 Medium
- unknown embedpressEmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database BloatingCVE-2026-850005.3 Medium
- sunshinephotocart sunshine photo cartSunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()CVE-2026-1080695.3 Medium
- unknown wp 2faWP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDORCVE-2026-1080662.7 Low
- unknown wp encryptionWP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handlerCVE-2026-1080646.5 Medium
- unknown file upload to orderFile Upload to Order < 1.1.4 - Unauthenticated Arbitrary File DeletionCVE-2026-10759410.0 Critical
- unknown ultimate multisiteUltimate Multisite < 2.17.2 - Unauthenticated LFI via 'attributes' ParameterCVE-2026-1075088.6 High
- ruben garcia gamipressGamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log DisclosureCVE-2026-1073205.3 Medium
- ruben garcia gamipressGamiPress < 8.0.6 - Subscriber+ Activity Log DisclosureCVE-2026-1073194.3 Medium
- unknown image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' ParameterCVE-2026-1071786.8 Medium
- unknown ltl freight quotesLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored HTML Injection via Checkout Error MessageCVE-2026-1071605.3 Medium
- unknown ltl freight quotesLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST RouteCVE-2026-1071585.3 Medium
- roland murg wp booking systemWP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For HeaderCVE-2026-1071268.8 High
- radiustheme classified listingClassified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX HandlersCVE-2026-1066465.9 Medium
- jegstudio gutenverse formGutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG IconCVE-2026-1064696.8 Medium
- basix nex-formsNEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' ParameterCVE-2026-1061665.3 Medium
- passionate programmer peter wp data accessWP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table ExportCVE-2026-1060995.3 Medium
- passionate programmer peter wp data accessWP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App UpdateCVE-2026-1060985.3 Medium
- unknown campay shortcode payment gatewayCamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_referenceCVE-2026-1059755.3 Medium
- unknown codeatoz b2b suite for woocommerceCodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote DisclosureCVE-2026-1059695.3 Medium
- publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categoriesPublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode AttributesCVE-2026-1052616.8 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results DeletionCVE-2026-1047515.3 Medium
- unknown image photo gallery final tiles gridImage Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration UpdateCVE-2026-1046446.8 Medium
- unknown walletdoc payment gateway for woocommerceWalletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via WebhookCVE-2026-1033078.6 High
- link whisper inc whisper free, unknown link whisper free +1 moreWordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerabilityCVE-2026-1096877.6 High
- brainstorm force sureformsWordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1084956.5 Medium
- cmsjunkie - wordpress business directory plugins wp-businessdirectoryWP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFileCVE-2026-892715.3 Medium
- trustindex.io wp testimonialsWP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials ShortcodeCVE-2026-892696.8 Medium
- unknown weaver xtreme theme supportWordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-548706.5 Medium
- pluggabl llc. booster elite for woocommerceWordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerabilityCVE-2023-259966.5 Medium
- nicdark hotel bookingHotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDORCVE-2026-841674.3 Medium
- nicdark hotel bookingHotel Booking <= 3.8 - Booking Order Creation, Deletion, and Modification via CSRFCVE-2026-841664.3 Medium
- unknown wp comment cleanerWP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_commentCVE-2026-1077916.5 Medium
- unknown hirezootWP Job Openings < 4.0.0 - Admin+ Stored XSSCVE-2025-157033.5 Low
- unknown wp-invoiceWP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX HandlersCVE-2026-971834.3 Medium
- piotnetdotcom piotnet formsPiotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File UploadCVE-2026-962278.8 High
- unknown veeqo for woocommerceVeeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connection_processCVE-2026-935504.3 Medium
- markjaquith subscribe to commentsSubscribe to Comments < 2.3.3 - Reflected XSS via 'ref' ParameterCVE-2026-918297.1 High
- unknown paymendoPaymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' ParameterCVE-2026-893056.5 Medium
- unknown paymendoPaymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' ParameterCVE-2026-893046.5 Medium
- unknown post voting systemPost Voting System <= 1.0 - Unauthenticated SQLi via 'id' ParameterCVE-2026-893028.6 High
- Show moreLoading…