Skip to contentUnknown vulnerabilities
Newest
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.30 - Subscriber+ User Email Address DisclosureCVE-2026-1073424.3 Medium
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] ParameterCVE-2026-113965.3 Medium
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON ParameterCVE-2026-889426.1 Medium
- unknown payable payment gateway for woocommercePAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned CallbackCVE-2026-943615.3 Medium
- fullworks quick event managerQuick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS DownloadCVE-2026-822145.3 Medium
- mapster wp maps, unknown mapster wp maps +1 moreMapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST RouteCVE-2026-1186387.5 High
- plugins360 all-in-one video galleryAll-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video DisclosureCVE-2026-1186295.3 Medium
- firelightwp firelight lightboxFirelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' AttributeCVE-2026-1184386.8 Medium
- themekraft buddyformsBuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment DeletionCVE-2026-1184373.7 Low
- unknown security optimizerSecurity Optimizer < 1.6.9 - 2FA Bypass via Missing Rate LimitingCVE-2026-1181857.5 High
- shahjada premium packagesPremium Packages < 7.2.2 - Unauthenticated Order Total ManipulationCVE-2026-1181845.3 Medium
- unknown bulk media registerBulk Media Register < 2.01 - Author+ Arbitrary File Move via Path TraversalCVE-2026-1180437.2 High
- unknown essential addons for elementorEssential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_roleCVE-2026-1108084.2 Medium
- kendysond payment forms for paystackPayment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings PageCVE-2026-1100424.9 Medium
- buildwps ppwp – password protect pagesPPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker CollisionCVE-2026-1165207.2 High
- tryghost activitypubActivityPub Undo handler can unfollow or remove reposts on behalf of other accountsCVE-2026-631155.3 Medium
- unknown pdf invoices & packing slips for woocommercePDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note FieldsCVE-2026-1115787.5 High
- liquid web / stellarwp bookitWordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerabilityCVE-2026-620194.3 Medium
- likebtn like button rating ♥ likebtnLike Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' HeaderCVE-2026-1165524.7 Medium
- unknown wpgraphql smart cache, wpgraphql smart cache +1 moreWPGraphQL Smart Cache before 2.3.3 Unbounded Persisted Query Storage DoSCVE-2026-1196996.9 Medium
- firelightwp firelight lightboxFirelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' AttributeCVE-2026-1181656.8 Medium
- themekraft buddyformsBuddyForms < 2.10.1 - Subscriber+ Arbitrary Post ModificationCVE-2026-1181015.3 Medium
- themekraft buddyformsBuddyForms < 2.10.3 - Unauthenticated Form Configuration DisclosureCVE-2026-1181005.3 Medium
- dots fraud prevention for woocommerce and eddFraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer BlacklistingCVE-2026-1180725.4 Medium
- unknown joinchatJoinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message AttributeCVE-2026-1180716.8 Medium
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' ParameterCVE-2026-1175724.1 Medium
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device ParametersCVE-2026-1175718.8 High
- unknown user frontendWP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' ParameterCVE-2026-1152774.7 Medium
- unknown security plugin, firewall & malware scanner with auto removalSecurity by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File ViewerCVE-2026-1144444.4 Medium
- unknown security plugin, firewall & malware scanner with auto removalSecurity by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App CodeCVE-2026-1144437.5 High
- shortpixel enable media replaceEnable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata ReplacerCVE-2026-1144227.5 High
- liedekef events made easyEvents Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode AttributeCVE-2026-1186346.4 Medium
- themeum wp crowdfundingWordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerabilityCVE-2026-1180837.5 High
- 10web social photo feed, unknown 10web social photo feed +1 moreWordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerabilityCVE-2026-1180818.8 High
- themeum wp crowdfundingWordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-426927.1 High
- brainstorm force sureformsWordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerabilityCVE-2026-1163875.3 Medium
- stylemix masterstudy lms wordpress pluginMasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajaxCVE-2026-800695.3 Medium
- stylemix masterstudy lms wordpress pluginMasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step ParameterCVE-2026-800675.3 Medium
- brainstorm force sureformsWordPress SureForms plugin <= 2.12.9 - Content Injection vulnerabilityCVE-2026-1164025.3 Medium
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-1180876.5 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field MappingCVE-2026-1153033.7 Low
- jackdewey community eventsCommunity Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission FormCVE-2026-867948.8 High
- bplugins video player for youtubeYT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajaxCVE-2026-850073.8 Low
- jordy meow photo engine (media organizer & lightroom)Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDORCVE-2026-1152594.9 Medium
- unknown chat ai with dispatcherChat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File UploadCVE-2026-1152459.8 Critical
- paolo geodirectoryGeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content DisclosureCVE-2026-1142705.3 Medium
- unknown automated import products to cartAutomated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path TraversalCVE-2026-1136179.9 Critical
- unknown logixfast authLogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password ResetCVE-2026-1136169.8 Critical
- unknown all-in-one security (aios), two factor authentication +1 moreTwo Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' ParameterCVE-2026-1117397.5 High
- opajaap wp photo album plusWP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRFCVE-2026-1109834.3 Medium
- Show moreLoading…