Skip to contentUnknown vulnerabilities
Newest
- gpriday page builder by siteoriginPage Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.classCVE-2026-1105066.8 Medium
- payplug for woocommerce (official), unknown payplug for woocommerce (official) +1 morePayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intentCVE-2026-1102926.5 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.3.81 - 1.7.1069 - Unauthenticated Non-Public Post Content Disclosure via wpr_get_page_contentCVE-2026-1071005.3 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height SettingCVE-2026-1070986.8 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribeCVE-2026-1070975.3 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID CollisionCVE-2026-1066473.8 Low
- unknown court reservationCourt Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and DeletionCVE-2026-1060035.3 Medium
- unknown court reservationCourt Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge DeletionCVE-2026-1060025.3 Medium
- masaakitanaka booking packageBooking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary RecipientCVE-2026-1059975.3 Medium
- unknown menu cart for woocommerceWooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation AttributeCVE-2026-1059727.5 High
- thrive themes automator, unknown thrive automator +1 moreThrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' ParameterCVE-2026-1046946.8 Medium
- unknown checkout files upload for woocommerceCheckout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File UploadCVE-2026-103688Public exploit9.8 Critical
- unknown casso flowCasso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment ConfirmationCVE-2026-1033825.3 Medium
- unknown payconiqPayconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key DisclosureCVE-2026-1033725.3 Medium
- unknown unipay payment gateway for woocommerceUniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Payment Forgery via Empty IPN SecretCVE-2026-1033315.3 Medium
- unknown paydunya woocommerce payment gatewayPayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook ForgeryCVE-2026-1033595.3 Medium
- unknown tiendacrypto para woocommerceTiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC BypassCVE-2026-1033253.7 Low
- unknown payment integration wompiPayment Integration Wompi <= 4.0.1 - Unauthenticated Payment Confirmation Forgery via IPN CallbackCVE-2026-1033125.3 Medium
- unknown payex payment gateway for woocommercePayex Payment Gateway for WooCommerce <= 1.2.10 - Unauthenticated Payment Confirmation Forgery via Empty-Default Secret KeyCVE-2026-1033325.3 Medium
- unknown eurobank woocommerce payment gatewayEurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified CallbackCVE-2026-1033005.3 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via CurrencyCVE-2026-1119745.3 Medium
- unknown mintpay for woocommerceMintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback ForgeryCVE-2026-1033816.5 Medium
- unknown opay payment gateway for woocommerceOPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret KeyCVE-2026-1033195.3 Medium
- unknown online payments with ik pay gatewayiKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via CallbackCVE-2026-1033065.3 Medium
- unknown payment gatewaynexi Alpha Bank for WooCommerce <= 2.2.0 - Unauthenticated Payment Confirmation Forgery via Empty Shared SecretCVE-2026-1032995.3 Medium
- unknown ccavenue payment gateway for woocommerceCCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook ForgeryCVE-2026-1032985.3 Medium
- unknown duplicatorDuplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click UpgradeCVE-2026-1152517.2 High
- unknown datawiza proxy auth pluginDatawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role HeadersCVE-2026-1152149.8 Critical
- qodeinteractive qi addons for elementorQi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text WidgetCVE-2026-1151832.4 Low
- instawp connect, unknown instawp connect +1 moreInstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settingsCVE-2026-1147433.1 Low
- unknown wpvrWP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDORCVE-2026-1147422.7 Low
- unknown wpvrWP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDORCVE-2026-1147413.8 Low
- unknown wpvrWP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup WizardCVE-2026-1147404.9 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addressesCVE-2026-1119812.7 Low
- stellarwp givewpGiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability GrantCVE-2026-1119805.5 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary ColorCVE-2026-1119796.8 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings ImportCVE-2026-1119786.0 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View RouteCVE-2026-1119765.3 Medium
- unknown chikkili- google pay india for woocommerceChikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified SignatureCVE-2026-942955.3 Medium
- unknown wp stripe checkoutWP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Webhook Signing SecretCVE-2026-1102855.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.8.0 - Admin+ Stored XSSCVE-2025-157053.5 Low
- christoph vielgrader relevanssiWordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerabilityCVE-2026-1147047.2 High
- unknown wpvrWP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot ContentCVE-2026-1144296.8 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing ModificationCVE-2026-1136743.7 Low
- paolo geodirectoryGeoDirectory < 2.8.194 - Admin+ RCE via DB Text ExportCVE-2026-1136737.2 High
- paolo geodirectoryGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width AttributeCVE-2026-1134936.8 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX ActionCVE-2026-1134925.3 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path TraversalCVE-2026-1134916.4 Medium
- paolo geodirectoryGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST EndpointCVE-2026-1134905.3 Medium
- blazethemes news kit addons for elementorNews Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_formCVE-2026-973535.4 Medium
- Show moreLoading…