Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-12
from 2 - Security Vulnerability (CVE-2026-123668)
The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged.
PLUGIN
from 2
CVE-2026-123668
Risk Score
Threat Entry
Updated 2026-09-11
from 2 - Security Vulnerability (CVE-2026-86809)
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained from a different transaction.
PLUGIN
from 2
CVE-2026-86809
Risk Score
Threat Entry
Updated 2026-09-08
from 2 - Security Vulnerability (CVE-2026-80439)
The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.
PLUGIN
from 2
CVE-2026-80439
Risk Score