Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-14
CVE-2026-11563 - Through 1 Plugin
The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php).
PLUGIN
Through 1
CVE-2026-11563
Risk Score
Threat Entry
Updated 2026-07-08
CVE-2026-12378 - Through 1 Plugin
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.
PLUGIN
Through 1
CVE-2026-12378
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-9677 - Through 1 Plugin
The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Through 1
CVE-2026-9677
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-7850 - Through 1 Plugin
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.
PLUGIN
Through 1
CVE-2026-7850
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-3881 - Through 1 Plugin
The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attacks
PLUGIN
Through 1
CVE-2026-3881
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2418 - Through 1 Plugin
The Login with Salesforce WordPress plugin through 1.0.2 does not validate that users are allowed to login through Salesforce, allowing unauthenticated users to be authenticated as any user (such as admin) by simply knowing the email
PLUGIN
Through 1
CVE-2026-2418
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1542 - Through 1 Plugin
The Super Stage WP WordPress plugin through 1.0.1 unserializes user input via REQUEST, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
PLUGIN
Through 1
CVE-2026-1542
Risk Score
Threat Entry
Updated 2026-02-12
CVE-2025-14892 - Through 1 Plugin
The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions due to a hardcoded secret.
PLUGIN
Through 1
CVE-2025-14892
Risk Score
Threat Entry
Updated 2026-02-09
CVE-2025-15491 - Through 1 Plugin
The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as with contributor or higher roles to perform LFI attacks
PLUGIN
Through 1
CVE-2025-15491
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-14316 - Through 1 Plugin
The AhaChat Messenger Marketing WordPress plugin through 1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Through 1
CVE-2025-14316
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-12573 - Through 1 Plugin
The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress plugin through 1.0.12 data.
PLUGIN
Through 1
CVE-2025-12573
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2025-10915 - Through 1 Theme
The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.
THEME
Through 1
CVE-2025-10915
Risk Score
Threat Entry
Updated 2026-01-02
CVE-2025-12685 - Through 1 Plugin
The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthenticated attacker to delete any customer through a CSRF attack.
PLUGIN
Through 1
CVE-2025-12685
Risk Score
Threat Entry
Updated 2025-12-31
CVE-2025-14313 - Through 1 Plugin
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Through 1
CVE-2025-14313
Risk Score
Threat Entry
Updated 2025-12-31
CVE-2025-14312 - Through 1 Plugin
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Through 1
CVE-2025-14312
Risk Score
Threat Entry
Updated 2025-12-23
CVE-2025-12820 - Through 1 Plugin
The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.
PLUGIN
Through 1
CVE-2025-12820
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-12696 - Through 1 Plugin
The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them
PLUGIN
Through 1
CVE-2025-12696
Risk Score
Threat Entry
Updated 2025-12-15
CVE-2025-9116 - Through 1 Plugin
The WPS Visitor Counter Plugin WordPress plugin through 1.4.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.
PLUGIN
Through 1
CVE-2025-9116
Risk Score
Threat Entry
Updated 2026-01-09
CVE-2025-13071 - Through 1 Plugin
The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Through 1
CVE-2025-13071
Risk Score
Threat Entry
Updated 2026-01-30
CVE-2025-13001 - Through 1 Plugin
The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks
PLUGIN
Through 1
CVE-2025-13001
Risk Score