Skip to contentUnknown vulnerabilities
Newest
- unknown payment gateway for telcellPayment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant SecretCVE-2026-1033015.3 Medium
- niteothemes cmp – coming soon & maintenanceCMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL WhitelistCVE-2026-1011385.3 Medium
- kevin stover ninja formsWordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-110899Public exploit7.1 High
- unknown cart abandonment recovery for woocommerceCart Abandonment Recovery for WooCommerce < 2.2.0 - Unauthenticated Authentication Bypass via Unsigned Recovery TokenCVE-2026-969013.7 Low
- unknown click n chat (chat widget integration)Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_actionCVE-2026-929995.3 Medium
- unknown click n chat (chat widget integration)Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' ParametersCVE-2026-929988.6 High
- unknown click n chat (chat widget integration)Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' ParameterCVE-2026-929978.6 High
- unknown translate wordpress with weglot 2.0Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link RewritingCVE-2026-887847.5 High
- unknown wava payment pluginWava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install WebhookCVE-2026-878386.5 Medium
- unknown wava payment pluginWava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment WebhookCVE-2026-878375.3 Medium
- codename065 download managerDownload Manager (Free & Pro) - Privacy Settings Update via CSRFCVE-2026-866114.3 Medium
- unknown formidable formsFormidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoSCVE-2026-856427.5 High
- elementor website builder, unknown elementor website builder +1 moreElementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer BypassCVE-2026-818136.8 Medium
- elementor website builder, unknown elementor website builder +1 moreElementor < 4.3.5 - Author+ Stored XSS via SVG UploadCVE-2026-818126.4 Medium
- saad iqbal advanced file managerAdvanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff BypassCVE-2026-796277.1 High
- templateinvaders ti woocommerce wishlistTI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_keyCVE-2026-152615.3 Medium
- unknown sumit payment gateway for woocommerceSUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect CallbackCVE-2026-1119575.3 Medium
- unknown wholesalexWholesaleX < 3.0.9 - Unauthenticated Imported User CSV DisclosureCVE-2026-1119565.9 Medium
- unknown wholesalexWholesaleX < 3.0.9 - Unauthenticated Account Activation and Administrator Approval BypassCVE-2026-1119556.5 Medium
- unknown miniorange 2faminiOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor RebindingCVE-2026-1119497.5 High
- unknown user profile builderProfile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row ActionsCVE-2026-1119487.1 High
- unknown pricing table wordpress pluginEasy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table DuplicationCVE-2026-1119475.5 Medium
- unknown kliken: ads + pixel for metaKliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDORCVE-2026-1115965.3 Medium
- themeisle redirection for contact form 7Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug MetaboxCVE-2026-1115747.5 High
- jordy meow ai engineAI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerptCVE-2026-1109824.9 Medium
- unknown swift performance liteSwift Performance Lite < 2.3.7.4 - Author+ SQLi via Image OptimizerCVE-2026-1106516.8 Medium
- unknown wp user manager, wp user manager user manager +1 moreWP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe DisconnectCVE-2026-1105238.1 High
- unknown wpzoom portfolio liteWPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDORCVE-2026-1105144.9 Medium
- productive minds commerce, unknown productive commerce +1 moreProductive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin ActivationCVE-2026-1099264.3 Medium
- roland murg wp booking systemWP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' ParameterCVE-2026-1091477.1 High
- surecartSureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' ParameterCVE-2026-1080735.3 Medium
- unknown hirezootWP Job Openings < 4.1.1 - Author+ Stored XSS via Job TitleCVE-2026-1077906.8 Medium
- unknown smartyparcelSmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDORCVE-2026-1077895.3 Medium
- unknown smartyparcelSmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label DeletionCVE-2026-1077884.3 Medium
- unknown simple bannerSimple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions SettingCVE-2026-1075067.5 High
- revmakx backup and staging by wp time capsuleBackup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_liveCVE-2026-1072378.2 High
- uncanny owl toolkit for learndash, unknown uncanny toolkit for learndash +1 moreUncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing AuthorizationCVE-2026-1071285.0 Medium
- uncanny owl toolkit for learndash, unknown uncanny toolkit for learndash +1 moreUncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRFCVE-2026-1071277.5 High
- moloniMoloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoiceCVE-2026-1069326.5 Medium
- masaakitanaka booking packageBooking Package < 1.7.31 - Unauthenticated Calendar Account Information DisclosureCVE-2026-1059995.3 Medium
- masaakitanaka booking packageBooking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing AuthorizationCVE-2026-1059985.3 Medium
- masaakitanaka booking packageBooking Package < 1.7.31 - Unauthenticated Booking PII Disclosure and Cancellation via Predictable TokenCVE-2026-1059964.8 Medium
- unknown ettrick escape room bookingEttrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation BypassCVE-2026-1059925.3 Medium
- faboba falang multilanguage for wordpressFalang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term TranslationCVE-2026-1052628.0 High
- unknown appointment booking pluginLatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDORCVE-2026-1052572.7 Low
- unknown payment gateway for idramPayment Gateway for Idram < 2.1.6 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant SecretCVE-2026-1033025.3 Medium
- unknown modern event calendar pro, modern events calendar lite +1 moreModern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX ActionCVE-2026-1024997.7 High
- unknown synchrony financingSynchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST RouteCVE-2026-1001456.5 Medium
- duplicator pro, unknown duplicator pro, smub duplicator – backups & migration plugin – cloud backups, scheduled backups, & more +2 moreDuplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object InjectionCVE-2026-828148.8 High
- merv barrett easy property listingsEasy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX HandlersCVE-2026-969034.3 Medium
- Show moreLoading…