Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-26
CVE-2026-10835 - Before 3 Plugin
The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.
PLUGIN
Before 3
CVE-2026-10835
Risk Score
Threat Entry
Updated 2026-06-26
CVE-2026-10823 - Before 3 Plugin
The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.
PLUGIN
Before 3
CVE-2026-10823
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-10735 - Before 3 Plugin
Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.
PLUGIN
Before 3
CVE-2026-10735
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-10749 - Before 3 Plugin
The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplied serialized values without the WordPress meta API's double-serialization protection, allowing users with Contributor-level access and above to inject a PHP Object.
PLUGIN
Before 3
CVE-2026-10749
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-8157 - Before 3 Plugin
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
PLUGIN
Before 3
CVE-2026-8157
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-10530 - Before 3 Plugin
The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.
PLUGIN
Before 3
CVE-2026-10530
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-7385 - Before 3 Plugin
The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.
PLUGIN
Before 3
CVE-2026-7385
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-3220 - Before 3 Plugin
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
PLUGIN
Before 3
CVE-2026-3220
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-4106 - Before 3 Plugin
The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some PII (such as full name, city, state and country) of customers who placed orders in the last 7 days
PLUGIN
Before 3
CVE-2026-4106
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-3830 - Before 3 Plugin
The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
PLUGIN
Before 3
CVE-2026-3830
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1890 - Before 3 Plugin
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
PLUGIN
Before 3
CVE-2026-1890
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1430 - Before 3 Plugin
The WP Lightbox 2 WordPress plugin before 3.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2026-1430
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-15396 - Before 3 Plugin
The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 3
CVE-2025-15396
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-15030 - Before 3 Plugin
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
PLUGIN
Before 3
CVE-2025-15030
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-14973 - Before 3 Plugin
The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.
PLUGIN
Before 3
CVE-2025-14973
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-9543 - Before 3 Plugin
The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Before 3
CVE-2025-9543
Risk Score
Threat Entry
Updated 2026-01-02
CVE-2025-13456 - Before 3 Plugin
The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Before 3
CVE-2025-13456
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-14072 - Before 3 Plugin
The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.
PLUGIN
Before 3
CVE-2025-14072
Risk Score
Threat Entry
Updated 2026-01-02
CVE-2025-13029 - Before 3 Plugin
The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users.
PLUGIN
Before 3
CVE-2025-13029
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-12057 - Before 3 Plugin
The WavePlayer WordPress plugin before 3.8.0 does not have authorization in an AJAX action as well as does not validate the file to be copied locally, allowing unauthenticated users to upload arbitrary file on the server and lead to RCE
PLUGIN
Before 3
CVE-2025-12057
Risk Score