Skip to contentUnknown vulnerabilities
Newest
- merv barrett easy property listingsEasy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST APICVE-2026-969025.3 Medium
- automattic sensei lmsSensei LMS 4.26.4 Broken Access Control via save_new_messageCVE-2026-1123295.3 Medium
- automattic sensei lmsSensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAXCVE-2026-1123285.3 Medium
- app cheap builder, unknown app builder +1 moreApp Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.phpCVE-2026-942945.3 Medium
- unknown snap financeSnap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX ActionsCVE-2026-942725.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and ModificationCVE-2026-942315.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX ActionsCVE-2026-942305.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' ParameterCVE-2026-942295.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_dataCVE-2026-942285.3 Medium
- markjaquith subscribe to commentsSubscribe to Comments 2.3 - 2.3.2 - Author+ Email Header Injection via From Name SettingCVE-2026-918313.8 Low
- unknown ipospays payment gateway for woocommerceiPOSpays Payment Gateway for WooCommerce < 1.4.7 - Unauthenticated Payment Confirmation ForgeryCVE-2026-867915.3 Medium
- dan rossiter document galleryDocument Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature BypassCVE-2026-749225.3 Medium
- dan rossiter document galleryDocument Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode AttributesCVE-2026-749216.8 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.31.11 - Unauthenticated Negative Booking Total via Discount CodeCVE-2026-1100343.7 Low
- unknown bdm digital payment gatewayBDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation ForgeryCVE-2026-1060105.3 Medium
- unknown coinbase commerce payment gateway for woocommerceCoinbase Commerce Payment Gateway for WooCommerce <= 1.4.1 - Unauthenticated Webhook Signature Bypass via Empty-Default Webhook Shared SecretCVE-2026-1033115.3 Medium
- unknown snap financeSnap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_paymentCVE-2026-942735.3 Medium
- quomodosoft elementsready addons for elementorElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' ParameterCVE-2026-910475.3 Medium
- quomodosoft elementsready addons for elementorElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing AuthorizationCVE-2026-910464.3 Medium
- unknown formflow for gohighlevel (ghl)FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log FileCVE-2026-892865.3 Medium
- blazethemes blaze demo importerBlaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG UploadCVE-2026-1069336.8 Medium
- unknown gateway for vantiv on wcGateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback ForgeryCVE-2026-1060145.3 Medium
- unknown activetrail for woocommerceActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon CreationCVE-2026-1060285.3 Medium
- bootstrap shortcodes project shortcodes, unknown bootstrap shortcodes +1 moreThe Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id...CVE-2026-1121115.1 Medium
- unknown modern event calendar pro, modern events calendar lite +1 moreModern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_exportCVE-2026-965347.7 High
- jordy meow ai engineAI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_mediaCVE-2026-1110414.9 Medium
- opajaap wp photo album plusWP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' ParameterCVE-2026-1109817.1 High
- jordy meow ai engineAI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_mediaCVE-2026-1109764.9 Medium
- unknown modern events calendar liteModern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDORCVE-2026-1100706.5 Medium
- unknown modern events calendar liteModern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX ActionsCVE-2026-1100694.3 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST RouteCVE-2026-1100354.3 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'CVE-2026-1100336.8 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer EditorCVE-2026-1100325.5 Medium
- dimitri grassi salon booking systemSalon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta KeyCVE-2026-1100317.2 High
- strategy11 team tasty recipes liteTasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and DeletionCVE-2026-1100264.9 Medium
- pickplugins product designer for woocommerce, unknown pickplugins product designer for woocommerce +1 moreProduct Designer <= 1.0.40 - Unauthenticated Design Template Data InjectionCVE-2026-878445.3 Medium
- unknown otter blocksOtter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout BlockCVE-2026-1099375.4 Medium
- blair williams thirstyaffiliatesThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic InjectionCVE-2026-973146.5 Medium
- unknown acf frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.13 - Admin+ PHP Object InjectionCVE-2026-813446.6 Medium
- unknown acf frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form SubmissionCVE-2026-813435.3 Medium
- unknown wp user manager, wp user manager user manager +1 moreWP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment BypassCVE-2026-1105275.3 Medium
- patreon wordpress, unknown patreon wordpress +1 morePatreon WordPress < 1.10.0 - Open Redirect via 'state' ParameterCVE-2026-924324.3 Medium
- passionate programmer peter wp data accessWP Data Access < 5.5.88 - Subscriber+ SSRFCVE-2026-1064705.0 Medium
- unknown ukr-to-latUkr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term NameCVE-2026-1041226.8 Medium
- peachpay — payments & express checkout for woocommerce (supports stripe, paypal, square, authorize.net, nmi), unknown peachpay — payments & express checkout for woocommerce (supports stripe, paypal, square, authorize.net, nmi) +1 morePeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status CheckCVE-2026-1033765.3 Medium
- patreon wordpress, unknown patreon wordpress +1 morePatreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRFCVE-2026-924336.5 Medium
- patreon wordpress, unknown patreon wordpress +1 morePatreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term EnumerationCVE-2026-924313.7 Low
- bannersky bsk pdf managerBSK PDF Manager <= 3.8.1 - Contributor+ SQLi via tags_specific Shortcode AttributeCVE-2026-910746.8 Medium
- unknown contact form 7 signature addonContact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email AttachmentsCVE-2026-104246Public exploit5.9 Medium
- liquid web / stellarwp bookitWordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerabilityCVE-2026-1109005.3 Medium
- Show moreLoading…