Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-01
CVE-2026-11883 - Webauthn Provider For Two Factor Plugin
The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.
PLUGIN
Webauthn Provider For Two Factor
CVE-2026-11883
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-11887 - Salon Booking System Plugin
The Salon Booking System WordPress plugin before 10.30.20 does not have proper authorisation checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to modify a Salon Booking System WordPress plugin before 10.30.20 setting and bypass the manual approval of new bookings.
PLUGIN
Salon Booking System
CVE-2026-11887
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-11570 - User Submitted Posts Plugin
The User Submitted Posts WordPress plugin before 20260608 does not escape a submitted value before outputting it in an admin-configured display template, leading to a Stored Cross-Site Scripting that can be triggered by unauthenticated users when a non-default display option is enabled.
PLUGIN
User Submitted Posts
CVE-2026-11570
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-11880 - Fluent Forms Plugin
The Fluent Forms WordPress plugin before 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with a low-privilege account to cancel subscriptions belonging to other users.
PLUGIN
Fluent Forms
CVE-2026-11880
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-10750 - Royal Mcp Plugin
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
PLUGIN
Royal Mcp
CVE-2026-10750
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-11562 - Ws Form Lite Plugin
The WS Form LITE WordPress plugin before 1.11.8 does not have a capability check on one of its settings-update actions, allowing authenticated users with subscriber-level access and above to modify the WS Form LITE WordPress plugin before 1.11.8's settings.
PLUGIN
Ws Form Lite
CVE-2026-11562
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-9107 - Kali Forms — Contact Form & Drag-and-Drop Builder Plugin
The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'meta[kaliforms_field_components]' parameter in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Kali Forms — Contact Form & Drag-and-Drop Builder
CVE-2026-9107
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-6070 - Wp Businessdirectory Plugin
The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is accepted with RAW filter (no sanitization), and the helper function makePathFile() only normalizes directory separator characters without stripping path traversal sequences (../). When combined with the _path_type=2 parameter, which sets the base directory to the plugin's site folder, an…
PLUGIN
Wp Businessdirectory
CVE-2026-6070
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-7517 - Custom Payment Gateways For Woocommerce Plugin
The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable by unauthenticated guest users submitting a crafted checkout POST request, requiring no custom input fields to be configured in the plugin.
PLUGIN
Custom Payment Gateways For Woocommerce
CVE-2026-7517
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-2387 - Event Organiser Plugin
The Event Organiser plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.12.9. This is due to the 'eo_events' shortcode accepting attacker-controlled 'no_events' content and rendering it in event list templates without output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Event Organiser
CVE-2026-2387
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-13468 - Charts Manager With Built In Ai Generator Plugin
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — including charts in draft, private, pending, future, or trash status — as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is…
PLUGIN
Charts Manager With Built In Ai Generator
CVE-2026-13468
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-12923 - Youtube Showcase Plugin
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP function name with no arguments via `$sess_name()`. The handler is gated only by a nonce — no current_user_can() check is present — and the nonce is emitted on any front-end page that renders a…
PLUGIN
Youtube Showcase
CVE-2026-12923
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-13731 - WPBot – AI ChatBot for Live Support, Lead Generation, AI Services Plugin
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous…
PLUGIN
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
CVE-2026-13731
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-13443 - Elearning And Online Course Solution Plugin
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Elearning And Online Course Solution
CVE-2026-13443
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-13246 - Donation Plugin And Fundraising Platform
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'block_id' (and other) shortcode attributes of the 'givewp_campaign_comments' shortcode in versions up to, and including, 4.16.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render(), where the blockId value is interpolated directly into a single-quoted HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever…
PLUGIN
Donation Plugin And Fundraising Platform
CVE-2026-13246
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-13015 - Wp Google Places Review Slider Plugin
The Wp Google Places Review Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'place' parameter in versions up to, and including, 18.1. This is due to insufficient input sanitization and output escaping in admin/partials/googlecrawl_dfs.php, where the $_GET['place'] value is URL-decoded, stripslashes()'d, and echoed directly into an HTML value attribute with no esc_attr() call when the supplied place is not already a stored key in the wprev_google_crawls option. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can…
PLUGIN
Wp Google Places Review Slider
CVE-2026-13015
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-12110 - Taskbuilder – Project Management & Task Management Tool With Kanban Board Plugin
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'task_search' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The wppm_get_task_list AJAX handler performs no…
PLUGIN
Taskbuilder – Project Management & Task Management Tool With Kanban Board
CVE-2026-12110
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-12135 - Fv Flowplayer Video Player Plugin
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_player' shortcode 'align' attribute in all versions up to, and including, 7.5.51.7212 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Fv Flowplayer Video Player
CVE-2026-12135
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-12127 - WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More Plugin
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 1.10.2 This is due to `get_reply_to_address()` processing the Reply-To display name through smart-tag expansion with context `'notification'` instead of `'notification-reply-to'`, which bypasses email-address validation while `wpforms_sanitize_textarea_field()` intentionally preserves CR/LF characters that are never stripped before the display name is concatenated into the raw `Reply-To:` mail header string. This makes it possible for unauthenticated attackers…
PLUGIN
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
CVE-2026-12127
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-12904 - Kadence Blocks Plugin
The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.7.7. This is due to a mismatch between the object used for authorization and the object actually accessed in the Optimize_Rest_Controller's create_item(), get_item(), delete_item(), and bulk_delete_items() endpoints — authorization is checked via current_user_can('edit_post'/'delete_post', $post_id) against the user-supplied post_id, while the storage layer keys analysis records on sha256($post_path) from a separately supplied, attacker-controlled post_path parameter, with no enforcement that post_path corresponds to post_id. This makes…
PLUGIN
Kadence Blocks
CVE-2026-12904
Risk Score