Skip to contentUnknown vulnerabilities
Newest
- bogdan bendziukov squeezeSqueeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachmentCVE-2026-1100295.4 Medium
- unknown maioMAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API KeyCVE-2026-1099305.3 Medium
- liedekef events made easyEvents Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' ParameterCVE-2026-1076495.4 Medium
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerabilityCVE-2026-1103665.3 Medium
- unknown product delivery date for woocommerceProduct Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX ActionsCVE-2026-1101912.7 Low
- unknown affiliate-toolkitaffiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby ParameterCVE-2026-1101796.8 Medium
- unknown otp login & register woocommerceOTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute ForceCVE-2026-1101357.4 High
- unknown smushSmush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on MultisiteCVE-2026-1100392.7 Low
- dimitri grassi salon booking systemSalon Booking System < 10.31.9 - Administrator Account Creation via CSRFCVE-2026-1100158.8 High
- dimitri grassi salon booking systemSalon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and StatusCVE-2026-1100145.3 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-TokenCVE-2026-1100134.8 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcomingCVE-2026-1100124.3 Medium
- unknown mb custom post types & custom taxonomiesMB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI MigrationCVE-2026-1099824.2 Medium
- dan rossiter document galleryDocument Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_iconsCVE-2026-749235.3 Medium
- unknown visual form builderVisual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetCVE-2026-1059744.3 Medium
- unknown visual form builderVisual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing AuthorizationCVE-2026-1059734.3 Medium
- mobile builder builder, unknown mobile builder +1 moreMobile Builder <= 1.4.2 - Unauthenticated SQLi via 'delivery_id' ParameterCVE-2026-1036966.8 Medium
- unknown coinsnap bitcoin crowdfundingCoinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret DisclosureCVE-2026-924275.3 Medium
- unknown wx subscribe 微信支付付费订阅WX Subscribe <= 1.2.1 - Unauthenticated SQLi via 'attach' ParameterCVE-2026-918336.8 Medium
- markjaquith subscribe to commentsSubscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment CookieCVE-2026-918306.5 Medium
- elvinhaci sql chart builderSQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User FieldCVE-2026-1001586.4 Medium
- link whisper inc whisper free, unknown link whisper free +1 moreWordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerabilityCVE-2026-1096869.8 Critical
- link whisper inc whisper free, unknown link whisper free +1 moreWordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerabilityCVE-2026-1096889.3 Critical
- link whisper inc whisper free, unknown link whisper free +1 moreWordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1096857.1 High
- unknown rede itaú for woocommerceRede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit WebhookCVE-2026-924295.3 Medium
- unknown rede itaú for woocommerceRede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure WebhookCVE-2026-924285.3 Medium
- unknown cardinity payment gateway for woocommerceCardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Project SecretCVE-2026-1033245.3 Medium
- themeum tutor lmsTutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content OverwriteCVE-2026-965377.5 High
- dan rossiter document galleryDocument Gallery <= 5.1.1 - Reflected XSS via data-shortcode AttributeCVE-2026-749207.1 High
- prism it systems user rights access managerUser Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration HandlerCVE-2026-1091459.8 Critical
- unknown spin wheelSpin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin ResultCVE-2026-1060316.5 Medium
- unknown easy https redirection (ssl)Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL RewriteCVE-2026-1046434.2 Medium
- unknown easync bookingeaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template UpdateCVE-2026-1033045.3 Medium
- data443 tracking code managerTracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'CVE-2026-151806.1 Medium
- muralidharan ramasamy push notification for post and buddypressWordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerabilityCVE-2026-1074176.5 Medium
- cyberchimps responsive blocksResponsive Blocks < 2.3.0 - Unauthenticated HTML Injection in Form Notification EmailCVE-2026-973155.4 Medium
- tickeraTickera < 3.6.0.4 - Unauthenticated Order Payment Bypass via 2Checkout IPNCVE-2026-889985.3 Medium
- unknown wpforms lite, wpforms lite +1 moreWPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal CommerceCVE-2026-828445.3 Medium
- unknown visma pay for woocommerceVisma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return EndpointCVE-2026-1033086.5 Medium
- unknown wpcodeWPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode BypassCVE-2026-1013015.3 Medium
- 10up restricted site accessWordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerabilityCVE-2026-1102275.3 Medium
- strategy11team awp classifiedsAWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad PageCVE-2026-969045.3 Medium
- unknown cart abandonment recovery for woocommerceCart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDORCVE-2026-969005.3 Medium
- unknown paymentfor gateway for woocommercePaymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card CallbacksCVE-2026-943605.3 Medium
- unknown sifalo paySifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction IdCVE-2026-942615.3 Medium
- unknown sifalo paySifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order FailureCVE-2026-942605.3 Medium
- artbees sellkitSellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' ParameterCVE-2026-942545.3 Medium
- unknown yith woocommerce popupYITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta DeletionCVE-2026-924264.9 Medium
- rhewlif donation thermometerDonation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via ShortcodeCVE-2026-924096.8 Medium
- robokassa payment gateway for woocommerce, unknown robokassa payment gateway for woocommerce +1 moreRobokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to FailedCVE-2026-910765.3 Medium
- Show moreLoading…