Skip to contentUnknown vulnerabilities
Newest
- blazethemes news kit addons for elementorNews Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importerCVE-2026-973524.3 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDORCVE-2026-1134894.3 Medium
- unknown download monitorDownload Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download LinkCVE-2026-1122077.1 High
- unknown asvereinbaseasVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA ValidationCVE-2026-1109569.8 Critical
- unknown pixel tag manager for woocommercePixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container IDCVE-2026-1051996.8 Medium
- rustaurius front end usersFront End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-AssignmentCVE-2026-878356.5 Medium
- madrasthemes mas videosMAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlistCVE-2026-1079076.5 Medium
- unknown advanced twenty seventeenAdvanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_themeCVE-2026-1078875.4 Medium
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.9.2.4 - 0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution via Form Success MessageCVE-2026-942634.8 Medium
- cozmoslabs profile builderProfile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA BypassCVE-2026-1119654.3 Medium
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update ActionCVE-2026-942688.1 High
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update ActionCVE-2026-942679.0 Critical
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode AttributesCVE-2026-942646.8 Medium
- hwk-fr advanced custom fields: extended, unknown advanced custom fields: extended pro +1 moreAdvanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update ActionCVE-2026-942628.1 High
- litespeedtech litespeed cacheLiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice DismissalCVE-2026-1135013.1 Low
- litespeedtech litespeed cacheLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display OptimizationCVE-2026-1135007.5 High
- litespeedtech litespeed cacheLiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS RewritingCVE-2026-1134997.5 High
- averta depicter — popup & slider builderDepicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media UploadCVE-2026-1134725.4 Medium
- ghozylab popup builderPopup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type ParameterCVE-2026-1122303.7 Low
- unknown download monitorDownload Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST RouteCVE-2026-1122194.9 Medium
- unknown user profile builderProfile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email ChangeCVE-2026-1119827.2 High
- unknown user profile builderProfile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode AttributeCVE-2026-1119666.8 Medium
- siteground speed optimizerSpeed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-optionCVE-2026-1117385.5 Medium
- siteground speed optimizerSpeed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL ListsCVE-2026-1117373.5 Low
- unknown essential addons for elementorEssential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk ActionCVE-2026-1105373.8 Low
- unknown essential addons for elementorEssential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title TagCVE-2026-1105103.5 Low
- unknown otter blocksOtter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render FilterCVE-2026-1099367.5 High
- unknown otter blocksOtter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST APICVE-2026-1099355.3 Medium
- unknown otter blocksOtter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST APICVE-2026-1099345.3 Medium
- unknown otter blocksOtter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style AttributesCVE-2026-1099336.8 Medium
- jetbackupJetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup RestoreCVE-2026-104068Public exploit8.6 High
- roselldk webp expressWebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML ParserCVE-2026-973287.5 High
- unknown masterstudy lms wordpress pluginMasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student EnrollmentCVE-2026-888492.7 Low
- unknown link libraryLink Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' ParameterCVE-2026-783926.8 Medium
- jordy meow photo engine (media organizer & lightroom)Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDORCVE-2026-1119724.9 Medium
- jordy meow photo engine (media organizer & lightroom)Photo Engine < 6.5.8 - Author+ Stored XSS via Collection NameCVE-2026-1119716.8 Medium
- royal plugins mcp, unknown royal mcp +1 moreRoyal MCP < 1.5.7 - Authentication Bypass via Preview Link TokenCVE-2026-1119587.5 High
- unknown mb custom post types & custom taxonomiesMB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via ExportCVE-2026-1100112.7 Low
- unknown mb custom post types & custom taxonomiesMB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' ParameterCVE-2026-1100104.8 Medium
- unknown pixelyoursite, pixelyoursite pro +1 morePixelYourSite (Free & Pro) - Unauthenticated Stored XSS via CookieCVE-2026-1099877.2 High
- infility global, unknown infility global +1 moreInfility Global < 2.16.25 - Unauthenticated Google Translate API Key UpdateCVE-2026-1099313.7 Low
- unknown hipaa formsCM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_roleCVE-2026-1099277.2 High
- roxnor wp ultimate reviewWP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer EmailCVE-2026-1032344.8 Medium
- unknown fluentcart a new era of ecommerceFluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDORCVE-2026-1001425.3 Medium
- unknown jane menuJane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URLCVE-2026-856838.8 High
- unknown happyformsHappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_refererCVE-2026-145565.4 Medium
- unknown contest galleryContest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter IdentityCVE-2026-1074475.3 Medium
- latepointLatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' ParameterCVE-2026-1052565.3 Medium
- mra13 simple shopping cartSimple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification BypassCVE-2026-1046422.7 Low
- mra13 simple shopping cartSimple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN RecipientCVE-2026-1046415.3 Medium
- Show moreLoading…