Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-09
CVE-2026-8996 - Wp Time Capsule Plugin
The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 via the download_recent_decrypted_file_wptc. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract download the most recently admin-decrypted SQL database backup, which typically contains password hashes, user credentials, and other sensitive site configuration data stored in the 'recent_decrypted_file' option. Exploitation requires that an administrator has previously performed a decrypt action, causing the decrypted SQL backup file to exist in the plugin's…
PLUGIN
Wp Time Capsule
CVE-2026-8996
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-6910 - System Rezerwacji Online Plugin
The Bookero.pl – system rezerwacji online plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookero_products` shortcode's `hide_products` (and `filter_products`) attributes in versions up to and including 2.2. This is due to insufficient input sanitization and output escaping in the `bookero_products()` function — the raw attribute value is concatenated directly into an inline `` block without any escaping. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.
PLUGIN
System Rezerwacji Online
CVE-2026-6910
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-7558 - Token Of Trust Plugin
The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 4.0.2. This is due to the handle_export_table() function being registered on the WordPress 'init' hook, which fires for all requests, including those from unauthenticated visitors, without any capability check. This makes it possible for unauthenticated attackers to download a CSV file containing sensitive WooCommerce donation data, including order dates, order IDs, charitable donation amounts, and admin-only order edit URLs, simply by visiting any page on…
PLUGIN
Token Of Trust
CVE-2026-7558
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-4653 - Bp Toolkit Plugin
The Block, Suspend, Report for BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter in versions up to and including 3.6.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Bp Toolkit
CVE-2026-4653
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-15000 - Connect Contact Form 7 And Mailchimp Plugin
The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up to, and including, 0.9.78.06 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is only triggered when a privileged user (Administrator) performs a Contact Lookup for the email address submitted via the CF7 form, meaning execution is deferred until…
PLUGIN
Connect Contact Form 7 And Mailchimp
CVE-2026-15000
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-14343 - Download Manager Plugin
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' Shortcode Attributes in all versions up to, and including, 3.3.61 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post filters post content on save for users without unfiltered_html, only kses-allowed tag and attribute payloads that survive save-time filtering will reach the unescaped sink; however,…
PLUGIN
Download Manager
CVE-2026-14343
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-14342 - Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails Plugin
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in all versions up to, and including, 1.24.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
CVE-2026-14342
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-14245 - Miniorange Otp Verification Plugin
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed, and relying solely on a public `form_nonce` nonce that the plugin itself emits to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled `username_b` parameter to target any WordPress user without role restriction…
PLUGIN
Miniorange Otp Verification
CVE-2026-14245
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-13080 - WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell Plugin
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be…
PLUGIN
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
CVE-2026-13080
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-13011 - ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Plugin
The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.17.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the erp_list_employee…
PLUGIN
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
CVE-2026-13011
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-13771 - Customer Reviews For Woocommerce Plugin
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Shortcode Attribute in all versions up to, and including, 5.113.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Customer Reviews For Woocommerce
CVE-2026-13771
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-13253 - Ultimate Post Plugin
The Ultimate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moreResultsText' block attribute of the ultimate-post/advanced-search block in versions up to and including 5.0.31. This is due to insufficient input sanitization and output escaping in the Advanced_Search::content() render callback: the attribute value is filtered with wp_kses(), which strips disallowed HTML tags but does NOT escape HTML special characters such as double quotes in plain text, and the result is then concatenated directly into the data-viewmoretext HTML attribute without esc_attr(). This makes it possible for authenticated attackers,…
PLUGIN
Ultimate Post
CVE-2026-13253
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-13334 - Mang Board Wp Plugin
The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Mang Board Wp
CVE-2026-13334
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-13450 - GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view private GamiPress activity log entries belonging to any user, including badge earnings, points balance changes, and event records from integrated plugins such as WooCommerce, LearnDash, and BuddyPress. This is exploitable by any unauthenticated visitor because the…
PLUGIN
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress
CVE-2026-13450
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-12418 - User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration Plugin
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.7 via the 'wpuf_files_data' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post on the site, including posts authored by administrators. Exploitation requires access to any WPUF post submission form; this is achievable by users with no WordPress role, as…
PLUGIN
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration
CVE-2026-12418
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-12170 - AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alignment' attribute in all versions up to, and including, 10.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
CVE-2026-12170
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-12406 - User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration Plugin
The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary media attachments whose post_author is 0, such as guest and registration-form uploads, via the wpuf_file_del AJAX action. This is exploitable by unauthenticated visitors on any site where a WPUF shortcode is rendered…
PLUGIN
User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration
CVE-2026-12406
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-11359 - Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration Plugin
The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation and activation in versions up to, and including, 3.4. This is due to a missing capability check and missing nonce validation on the pg_install_profilegrid() AJAX handler registered via wp_ajax_pg_install_profilegrid. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ProfileGrid plugin from wordpress.
PLUGIN
Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration
CVE-2026-11359
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-12270 - Everest Forms Plugin
The Everest Forms WordPress plugin before 3.5.0 does not correctly restrict access to several REST API endpoints belonging to its onboarding assistant: the capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or changing that header. This makes it possible for unauthenticated attackers to read onboarding status information, modify the related Everest Forms WordPress plugin before 3.5.0 options, and trigger an email from the site to an arbitrary address.
PLUGIN
Everest Forms
CVE-2026-12270
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-12517 - Fediverse Embeds Plugin
The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated site-info endpoint before fetching it, allowing anonymous users (the gating nonce is exposed on public pages carrying an embed) to make the site request internal and private-network URLs and read back the parsed page metadata. This is a Server-Side Request Forgery.
PLUGIN
Fediverse Embeds
CVE-2026-12517
Risk Score