Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-03-11
CVE-2026-2707 - weForms – Easy Drag & Drop Contact Form Builder For WordPress Plugin
The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API (`/wp-json/weforms/v1/forms/{id}/entries/`), the `prepare_entry()` method in `class-abstract-fields.php` receives the WP_REST_Request object as `$args`, bypassing the `weforms_clean()` fallback that sanitizes `$_POST` data for frontend submissions. The base field handler only applies `trim()` to the value. This makes it possible for authenticated…
PLUGIN
weForms – Easy Drag & Drop Contact Form Builder For WordPress
CVE-2026-2707
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-2358 - WP ULike – Like & Dislike Buttons for Engagement and Feedback Plugin
The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[wp_ulike_likers_box]` shortcode `template` attribute in all versions up to, and including, 5.0.1. This is due to the use of `html_entity_decode()` on shortcode attributes without subsequent output sanitization, which effectively bypasses WordPress's `wp_kses_post()` content filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The post must have at least one like for the XSS to render.
PLUGIN
WP ULike – Like & Dislike Buttons for Engagement and Feedback
CVE-2026-2358
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1753 - Gutena Forms Plugin
The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register).
PLUGIN
Gutena Forms
CVE-2026-1753
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1867 - Front Editor Plugin
The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6 allows passing a URL parameter to regenerate a .json file based on demo data that it initially creates. If an administrator modifies the demo form and enables admin notifications in the Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6's settings, it is possible for an unauthenticated attacker to export and download all of the form data/settings, including the administrator's email address.
PLUGIN
Front Editor
CVE-2026-1867
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-2413 - Ally – Web Accessibility & Usability Plugin
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the `get_global_remediations()` method, where it is directly concatenated into an SQL JOIN clause without proper sanitization for SQL context. While `esc_url_raw()` is applied for URL safety, it does not prevent SQL metacharacters (single quotes, parentheses) from being injected. This makes it possible for unauthenticated attackers to append additional SQL queries into…
PLUGIN
Ally – Web Accessibility & Usability
CVE-2026-2413
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-3453 - Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.11. This is due to missing ownership validation on the change_plan_sub_id parameter in the process_checkout() function. The ppress_process_checkout AJAX handler accepts a user-controlled subscription ID intended for plan upgrades, loads the subscription record, and cancels/expires it without verifying the subscription belongs to the requesting user. This makes it possible for authenticated attackers, with Subscriber-level access and above, to cancel and expire any other user's active subscription via the change_plan_sub_id parameter during…
PLUGIN
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
CVE-2026-3453
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-1781 - Mailchimp For Wp Plugin
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source).
PLUGIN
Mailchimp For Wp
CVE-2026-1781
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-2324 - Calendar Booking Plugin For Appointments And Events
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.7. This is due to missing or incorrect nonce validation on the reload_preview() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Calendar Booking Plugin For Appointments And Events
CVE-2026-2324
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-2569 - Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer Plugin
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PDF page labels in all versions up to, and including, 2.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer
CVE-2026-2569
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-3228 - NextScripts: Social Networks Auto-Poster Plugin
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` shortcode in all versions up to, and including, 4.4.6. This is due to insufficient input sanitization and output escaping on the `snapFB` post meta value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
NextScripts: Social Networks Auto-Poster
CVE-2026-3228
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-2724 - Unlimited Elements For Elementor Plugin
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and including, 2.0.5. This is due to insufficient input sanitization and output escaping on form submission data displayed in the admin Form Entries Trash view. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the trashed form entries.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-2724
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-1261 - Metform Pro Plugin
The MetForm Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Quiz feature in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Metform Pro
CVE-2026-1261
Risk Score
Threat Entry
Updated 2026-04-08
CVE-2026-3585 - The Events Calendar Plugin
The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
The Events Calendar
CVE-2026-3585
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-1920 - Booktics – Booking Calendar for Appointments and Service Businesses Plugin
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.
PLUGIN
Booktics – Booking Calendar for Appointments and Service Businesses
CVE-2026-1920
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-1919 - Booktics – Booking Calendar for Appointments and Service Businesses Plugin
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.
PLUGIN
Booktics – Booking Calendar for Appointments and Service Businesses
CVE-2026-1919
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1508 - Court Reservation Plugin
The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via a CSRF attack
PLUGIN
Court Reservation
CVE-2026-1508
Risk Score
Threat Entry
Updated 2026-03-11
CVE-2026-0953 - Tutor Lms Pro Plugin
The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.
PLUGIN
Tutor Lms Pro
CVE-2026-0953
Risk Score
Threat Entry
Updated 2026-03-09
CVE-2026-2433 - RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Plugin
The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via postMessage in all versions up to, and including, 5.0.11. This is due to the plugin's admin-shell.js registering a global message event listener without origin validation (missing event.origin check) and directly passing user-controlled URLs to window.open() without URL scheme validation. This makes it possible for unauthenticated attackers to execute arbitrary JavaScript in the context of an authenticated administrator's session by tricking them into visiting a malicious website that…
PLUGIN
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
CVE-2026-2433
Risk Score
Threat Entry
Updated 2026-03-09
CVE-2026-2420 - Lotekmedia Popup Form Plugin
The LotekMedia Popup Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the frontend of the site where the popup is displayed.
PLUGIN
Lotekmedia Popup Form
CVE-2026-2420
Risk Score
Threat Entry
Updated 2026-03-09
CVE-2026-1825 - Show Youtube Video Plugin
The Show YouTube video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'syv' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Show Youtube Video
CVE-2026-1825
Risk Score