Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-9061 - Store Locator Plugin
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).
PLUGIN
Store Locator
CVE-2026-9061
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-9062 - Store Locator Plugin
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
PLUGIN
Store Locator
CVE-2026-9062
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-9848 - Customer Support Ticket System & Helpdesk Plugin
The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress's `posts_request` filter with `wp_ticket_com_posts_request()`, which calls `emd_author_search_results()` when the current request is an unauthenticated front-end search. That function reads `$query->query_vars['s']` — already wp_unslash()'d by `WP_Query::parse_query()`, so wp_magic_quotes protection has been stripped — and concatenates the raw value into a SQL `LIKE` clause inside a UNION sub-SELECT appended to the main query, with no `$wpdb->prepare()` or escaping. This makes it possible for…
PLUGIN
Customer Support Ticket System & Helpdesk
CVE-2026-9848
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-12089 - Lws Optimize Plugin
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combine_current_css() function trusting values harvested from page HTML and converting same-site URLs to absolute filesystem paths before reading them with file_get_contents()/Minify\CSS::add(), without enforcing that the resolved path stay within ABSPATH or have a .css extension. This makes it possible for authenticated attackers, with Editor-level access and above, to read arbitrary files.
PLUGIN
Lws Optimize
CVE-2026-12089
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-9269 - Secure Copy Content Protection And Content Locking Plugin
The Secure Copy Content Protection and Content Locking WordPress plugin before 5.1.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Secure Copy Content Protection And Content Locking
CVE-2026-9269
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-47365 - WordPress-Toolkit Plugin
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.
PLUGIN
WordPress-Toolkit
CVE-2026-47365
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-9125 - Presto Player Plugin
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays() function, which copies the link_url shortcode attribute directly into the overlay configuration without scheme validation, allowing javascript: URIs to survive and be rendered as the href of a clickable anchor element by the presto-dynamic-overlay-ui web component. This makes it possible for authenticated attackers, with contributor-level access and above, to inject…
PLUGIN
Presto Player
CVE-2026-9125
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-46698 - fediverse-embeds-wordpress-plugin
Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.9, Fediverse Embeds registered the unauthenticated AJAX action wp_ajax_nopriv_ftf_get_site_info (includes/Site_Info.php) that verified a nonce ftf-fediverse-embeds-nonce and then called file_get_html($site_url) on the attacker-supplied URL. The same nonce was enqueued onto every public page containing a fediverse embed (via includes/Enqueue_Assets.php lines 41-46 + includes/Helpers.php lines 64-83), so the nonce gate was not an authentication boundary; any visitor of a public post with an embed could grab it and reuse it. This issue has been patched in version 1.5.9.
PLUGIN
fediverse-embeds-wordpress-plugin
CVE-2026-46698
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-46697 - fediverse-embeds-wordpress-plugin
Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST route ftf/media-proxy (includes/Media_Proxy.php) with permission_callback => __return_true that accepted a base64-encoded URL and forwarded it to wp_remote_get($url) without enforcing any allowlist. The plugin's source contained a comment block explicitly acknowledging that the request should be validated against allowed fediverse domains, but in 1.5.7 the validation only set a local $can_download_media flag that was never read. The full response body was echoed back to the caller, so this was a full-read SSRF /…
PLUGIN
fediverse-embeds-wordpress-plugin
CVE-2026-46697
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-10795 - UpdraftPlus: WP Backup & Migration Plugin
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code…
PLUGIN
UpdraftPlus: WP Backup & Migration Plugin
CVE-2026-10795
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2827 - Open User Map Pro Plugin
The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in versions up to, and including, 1.4.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Open User Map Pro
CVE-2026-2827
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-53738 - Copy & Delete Posts Plugin
Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.
PLUGIN
Copy & Delete Posts
CVE-2026-53738
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-53742 - Simple Link Directory Plugin
Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser.
PLUGIN
Simple Link Directory
CVE-2026-53742
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-53741 - Simple Link Directory Plugin
Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.
PLUGIN
Simple Link Directory
CVE-2026-53741
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-53740 - Duplicate Post Plugin
Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.
PLUGIN
Duplicate Post
CVE-2026-53740
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-53739 - Duplicate Post Plugin
Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate_post_show_notice site option, suppressing admin notices network-wide.
PLUGIN
Duplicate Post
CVE-2026-53739
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-53737 - Juicer Plugin
Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.
PLUGIN
Juicer
CVE-2026-53737
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-53736 - Easy Twitter Feeds Plugin
Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type.
PLUGIN
Easy Twitter Feeds
CVE-2026-53736
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-3018 - Newsletters Lite Plugin
The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Newsletters Lite
CVE-2026-3018
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-9019 - Easy Image Collage Plugin
The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress's unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path…
PLUGIN
Easy Image Collage
CVE-2026-9019
Risk Score