Skip to contentUnknown vulnerabilities
Newest
- ideastocode enable svg, webp, and ico uploadEnable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation BypassCVE-2026-1105056.8 Medium
- ideastocode enable svg, webp, and ico uploadEnable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization BypassCVE-2026-1105046.8 Medium
- unknown hide price until loginHide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest RegistrationCVE-2026-1100305.3 Medium
- unknown wallet system for woocommerceWallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDORCVE-2026-1087634.3 Medium
- af themes wp post authorWP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key DisclosureCVE-2026-1086863.7 Low
- af themes wp post authorWP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile FieldsCVE-2026-1086853.7 Low
- unknown vtablesvTables < 0.3 - Unauthenticated SQL Injection via orderby ParameterCVE-2026-892168.6 High
- paycomet for woocommerce, unknown paycomet for woocommerce +1 morePAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification BypassCVE-2026-889286.5 Medium
- unknown appointment booking pluginLatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step SettingsCVE-2026-1052583.5 Low
- m a vinoth kumar frontend dashboard, metagauss profilegrid +1 moreFrontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object InjectionCVE-2026-1036939.0 Critical
- unknown letterpressLetterPress < 2.4.0 - Admin+ Stored XSSCVE-2024-35863.5 Low
- unknown link libraryLink Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information DisclosureCVE-2026-783965.3 Medium
- unknown link libraryLink Library < 7.10.0 - Unauthenticated Link Submission Login Requirement BypassCVE-2026-783955.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics DeletionCVE-2026-1153025.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text BlockCVE-2026-1153017.2 High
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRFCVE-2026-1153004.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRFCVE-2026-1152995.4 Medium
- unknown recipe card blocks liteRecipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content DisclosureCVE-2026-1152825.3 Medium
- brewlabs sendpress newslettersSendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' ParameterCVE-2026-938557.5 High
- saturday drive ninja formsNinja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List FieldsCVE-2026-671875.1 Medium
- crossi72 phoenix media renameWordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerabilityCVE-2026-1163898.8 High
- gs plugins logo slider, unknown gs logo slider +1 moreWordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerabilityCVE-2026-1163918.8 High
- supsysticcom smart popup by supsysticSmart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text BlockCVE-2026-1152234.9 Medium
- unknown essential addons for elementorEssential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP VerificationCVE-2026-1105085.3 Medium
- unknown royal elementor addonsRoyal Elementor Addons < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection via Form Field ID ShortcodesCVE-2026-1066485.3 Medium
- unknown sadad qa paymentSadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature BypassCVE-2026-1033305.3 Medium
- unknown bitpay gateway for woocommerceBitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return HandlerCVE-2026-1033135.3 Medium
- hornero clean loginClean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' HookCVE-2026-1166104.3 Medium
- unknown recipe card blocks liteRecipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' AttributeCVE-2026-1152816.8 Medium
- unknown wp rosterWP Roster < 2.35 - Unauthenticated Roster Member DeletionCVE-2026-1152555.3 Medium
- unknown customer engagement systemSmart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups LookupCVE-2026-1152255.8 Medium
- unknown customer engagement systemSmart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category BindingCVE-2026-1152244.1 Medium
- payplug for woocommerce (official), unknown payplug for woocommerce (official) +1 morePayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and DisclosureCVE-2026-1138136.5 Medium
- paolo geodirectoryGeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content ShortcodeCVE-2026-1134942.7 Low
- paolo geodirectoryGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' AttributeCVE-2026-1134886.8 Medium
- paolo geodirectoryGeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' AttributeCVE-2026-1134876.8 Medium
- david lingren media library assistantMedia Library Assistant < 3.42 - Trashed Attachment Deletion via CSRFCVE-2026-1134866.5 Medium
- david lingren media library assistantMedia Library Assistant < 3.42 - Bulk Attachment Deletion via CSRFCVE-2026-1134856.5 Medium
- unknown mp3 audio playerMP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode AttributeCVE-2026-111967Public exploit6.8 Medium
- royal plugins mcp, unknown royal mcp +1 moreRoyal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_pageCVE-2026-1119613.8 Low
- royal plugins mcp, unknown royal mcp +1 moreRoyal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search AbilityCVE-2026-1119604.3 Medium
- unknown gosmtpGoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP SettingsCVE-2026-1115777.2 High
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajaxCVE-2026-1110323.8 Low
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Unauthenticated Open Redirect via 'usces_referer' ParameterCVE-2026-1110314.7 Medium
- nanbu welcart e-commerceWelcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' ParameterCVE-2026-1110276.8 Medium
- unknown افزونه پیامک ووکامرس | persian woocommerce smsPersian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' ParameterCVE-2026-1110217.1 High
- unknown wporloginWPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug UpdateCVE-2026-1106916.5 Medium
- unknown copy anything to clipboard for wordpressCopy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode AttributeCVE-2026-1105246.8 Medium
- unknown essential addons for elementorEssential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX HandlerCVE-2026-1105095.3 Medium
- gpriday page builder by siteoriginPage Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query ArgumentsCVE-2026-1105072.7 Low
- Show moreLoading…