Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-14
CVE-2026-11390 - News Kit Elementor Addons Plugin
The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an attacker to intercept and modify the elementor_ajax AJAX save request in order to bypass the client-side SELECT control…
PLUGIN
News Kit Elementor Addons
CVE-2026-11390
Risk Score
Threat Entry
Updated 2026-07-15
CVE-2026-11802 - Foodbook Light Online Food Ordering System Plugin
The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration() function, accessible via the wp_ajax_nopriv_registration_action AJAX action, lacks any nonce verification or capability check, and does not check the WordPress users_can_register option before calling wp_insert_user(). This makes it possible for unauthenticated attackers to create new user accounts with the 'customer' role and receive authentication cookies, even when the site administrator has explicitly disabled user registration.
PLUGIN
Foodbook Light Online Food Ordering System
CVE-2026-11802
Risk Score
Threat Entry
Updated 2026-07-14
CVE-2026-12536 - Builder Plugin
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Module Title’ parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Builder
CVE-2026-12536
Risk Score
Threat Entry
Updated 2026-07-14
CVE-2026-12385 - Smart Slider 3 Plugin
The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts authored by any user, including Administrators and Editors. The required nonce is emitted on /wp-admin/post-new.php, which is accessible to Contributor-level users via the edit_posts capability, meaning any Contributor can obtain the nonce needed to trigger the injection.
PLUGIN
Smart Slider 3
CVE-2026-12385
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-61976 - Elementor Plugin
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through
PLUGIN
Elementor
CVE-2026-61976
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-57804 - Elementor Plugin
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows PHP Local File Inclusion.This issue affects TheGem Theme Elements (for Elementor): from n/a through
PLUGIN
Elementor
CVE-2026-57804
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-57718 - Elementor Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through
PLUGIN
Elementor
CVE-2026-57718
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-57423 - Contact Form 7 Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kofi Mokome Message Filter for Contact Form 7 cf7-message-filter allows Reflected XSS.This issue affects Message Filter for Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2026-57423
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-57411 - Contact Form 7 Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman CF7 Views – Complete Entry Management for Contact Form 7 cf7-views allows DOM-Based XSS.This issue affects CF7 Views – Complete Entry Management for Contact Form 7: from n/a through
PLUGIN
Contact Form 7
CVE-2026-57411
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-57376 - Elementor Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Elementor: from n/a through
PLUGIN
Elementor
CVE-2026-57376
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-12582 - Library Management System Plugin
The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.
PLUGIN
Library Management System
CVE-2026-12582
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-12396 - Wp Job Portal Plugin
The WP Job Portal WordPress plugin before 2.5.5 does not perform capability or ownership checks before allowing job moderation actions, allowing authenticated users with a subscriber-level (self-registerable) account to approve, feature, or reject arbitrary jobs, including those owned by other users.
PLUGIN
Wp Job Portal
CVE-2026-12396
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-12397 - Wp Job Portal Plugin
The WP Job Portal WordPress plugin before 2.5.5 does not verify ownership when returning an employer's contact email for a given job, allowing authenticated users with a subscriber-level (self-registerable) account to read other employers' private account email addresses by enumerating job identifiers.
PLUGIN
Wp Job Portal
CVE-2026-12397
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-11964 - Before 5 Plugin
The User Registration & Membership WordPress plugin before 5.2.2 does not verify the authenticity of incoming payment-provider webhook notifications before acting on them, allowing unauthenticated attackers to forge a payment-approved event and activate a paid membership subscription without completing a real payment.
PLUGIN
Before 5
CVE-2026-11964
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-11963 - Before 5 Plugin
The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change another user's WordPress role and membership tier.
PLUGIN
Before 5
CVE-2026-11963
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-12275 - Tutor Lms Plugin
The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.
PLUGIN
Tutor Lms
CVE-2026-12275
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-12274 - Tutor Lms Plugin
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
PLUGIN
Tutor Lms
CVE-2026-12274
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-12271 - Tutor Lms Plugin
The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.
PLUGIN
Tutor Lms
CVE-2026-12271
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-12081 - Elementor Forms Plugin
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.2 does not restrict the PHP classes allowed when unserializing an attacker-supplied form-field value, allowing unauthenticated users to inject arbitrary PHP objects that are instantiated when an administrator views the stored entry. This is an incomplete fix of CVE-2025-7384 and CVE-2026-2599, whose deserialization paths were hardened while the entry-editor file-field path was missed.
PLUGIN
Elementor Forms
CVE-2026-12081
Risk Score
Threat Entry
Updated 2026-07-13
CVE-2026-12273 - Tutor Lms Plugin
The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.
PLUGIN
Tutor Lms
CVE-2026-12273
Risk Score