Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-1165 - Ays Popup Box Plugin
The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for unauthenticated attackers to change the publish status of popups via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
PLUGIN
Ays Popup Box
CVE-2026-1165
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-14554 - Sell Btc By Hayyatapps Plugin
The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderform_data' AJAX action in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in order records that will execute whenever an administrator accesses the Orders page in the admin dashboard. The vulnerability was partially patched in version 1.5.
PLUGIN
Sell Btc By Hayyatapps
CVE-2025-14554
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1251 - Customer Support Ticket System Plugin
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'add_reply' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to steal file attachments uploaded by other users by specifying arbitrary attachment IDs in the 'description_attachments' parameter, re-associating those files to their own tickets and removing access from the original owners.
PLUGIN
Customer Support Ticket System
CVE-2026-1251
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-0683 - Customer Support Ticket System Plugin
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4. This is due to insufficient escaping on the user-supplied operand value when using the equals operator and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above (customers), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Customer Support Ticket System
CVE-2026-0683
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1431 - Booking Calendar Plugin
The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.
PLUGIN
Booking Calendar
CVE-2026-1431
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-15525 - Ajax Load More Plugin
The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts.
PLUGIN
Ajax Load More
CVE-2025-15525
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-15510 - Nex Forms Express Wp Form Builder Plugin
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal API credentials, and third-party integration keys by enumerating the nex_forms_Id parameter.
PLUGIN
Nex Forms Express Wp Form Builder
CVE-2025-15510
Risk Score
Threat Entry
Updated 2026-02-24
CVE-2026-24054 - Snapshots Plugin
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host…
PLUGIN
Snapshots
CVE-2026-24054
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14975 - Custom Login Page Customizer Plugin
The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
PLUGIN
Custom Login Page Customizer
CVE-2025-14975
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1060 - WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer Plugin
The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the complete list of available addons, their installation status, version numbers, and download URLs.
PLUGIN
WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer
CVE-2026-1060
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14795 - Stop Spammer Registrations Plugin
The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing nonce validation in the ss_addtoallowlist class. This makes it possible for unauthenticated attackers to add arbitrary email addresses to the spam allowlist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The vulnerability was partially patched in version 2026.1.
PLUGIN
Stop Spammer Registrations
CVE-2025-14795
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1056 - Snow Monkey Forms Plugin
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Snow Monkey Forms
CVE-2026-1056
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14865 - Content Protector Plugin
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortcode in all versions up to, and including, 4.2.24. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.2.21.
PLUGIN
Content Protector
CVE-2025-14865
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1391 - Vzaar Media Management Plugin
The Vzaar Media Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on the $_SERVER['PHP_SELF'] variable. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Vzaar Media Management
CVE-2026-1391
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1399 - WP Google Ad Manager Plugin
The WP Google Ad Manager Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
WP Google Ad Manager Plugin
CVE-2026-1399
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1398 - Change Wp Url Plugin
The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Change Wp Url
CVE-2026-1398
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-0844 - Simple User Registration Plugin
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
PLUGIN
Simple User Registration
CVE-2026-0844
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1280 - Frontend File Manager Plugin
The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated attackers to share arbitrary uploaded files via email by supplying a file ID. Since file IDs are sequential integers, attackers can enumerate all uploaded files on the site and exfiltrate sensitive data that was intended to be restricted to administrators only.
PLUGIN
Frontend File Manager Plugin
CVE-2026-1280
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1380 - Bitcoin Donate Button Plugin
The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to modify the plugin's settings, including donation addresses and display configurations, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Bitcoin Donate Button
CVE-2026-1380
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1377 - Imwptip Plugin
The imwptip plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Imwptip
CVE-2026-1377
Risk Score