Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-24946 - Print Invoice & Delivery Notes for WooCommerce Plugin
Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through
PLUGIN
Print Invoice & Delivery Notes for WooCommerce
CVE-2026-24946
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22354 - Woocommerce Category Banner Management Plugin
Deserialization of Untrusted Data vulnerability in Dotstore Woocommerce Category Banner Management banner-management-for-woocommerce allows Object Injection.This issue affects Woocommerce Category Banner Management: from n/a through
PLUGIN
Woocommerce Category Banner Management
CVE-2026-22354
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22352 - Persian Woocommerce SMS Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PersianScript Persian Woocommerce SMS persian-woocommerce-sms allows Reflected XSS.This issue affects Persian Woocommerce SMS: from n/a through
PLUGIN
Persian Woocommerce SMS
CVE-2026-22352
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22350 - PDF for Elementor Forms + Drag And Drop Template Builder Plugin
Missing Authorization vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through
PLUGIN
PDF for Elementor Forms + Drag And Drop Template Builder
CVE-2026-22350
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2486 - Master Addons For Elementor Plugin
The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Master Addons For Elementor
CVE-2026-2486
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-26370 - Survey Maker Plugin
WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
PLUGIN
Survey Maker
CVE-2026-26370
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2384 - Quiz Maker Plugin
The Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `vc_quizmaker` shortcode in all versions up to, and including, 6.7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This vulnerability requires WPBakery Page Builder to be installed and active
PLUGIN
Quiz Maker
CVE-2026-2384
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27327 - YayMail – WooCommerce Email Customizer Plugin
Missing Authorization vulnerability in YayCommerce YayMail – WooCommerce Email Customizer yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail – WooCommerce Email Customizer: from n/a through
PLUGIN
YayMail – WooCommerce Email Customizer
CVE-2026-27327
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2232 - Product Table And List Builder For Woocommerce Lite Plugin
The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Product Table And List Builder For Woocommerce Lite
CVE-2026-2232
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1581 - Wpforo Forum Plugin
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wpforo Forum
CVE-2026-1581
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2718 - Dealia – Request a quote Plugin
The Dealia – Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.8. This is due to the use of `wp_kses()` for output escaping within HTML attribute contexts where `esc_attr()` is required. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Dealia – Request a quote
CVE-2026-2718
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2716 - Client Testimonial Slider Plugin
The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Testimonial Heading' setting in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Client Testimonial Slider
CVE-2026-2716
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1461 - Simple Membership Plugin
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.
PLUGIN
Simple Membership
CVE-2026-1461
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1219 - Mp3 Music Player By Sonaar Plugin
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.
PLUGIN
Mp3 Music Player By Sonaar
CVE-2026-1219
Risk Score
Threat Entry
Updated 2026-04-28
CVE-2026-27066 - Live sales notification for WooCommerce Plugin
Missing Authorization vulnerability in PI Web Solution Live sales notification for WooCommerce live-sales-notifications-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live sales notification for WooCommerce: from n/a through
PLUGIN
Live sales notification for WooCommerce
CVE-2026-27066
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27052 - WooCommerce Plugin
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion.This issue affects Sales Countdown Timer for WooCommerce and WordPress: from n/a through < 1.1.9.
PLUGIN
WooCommerce
CVE-2026-27052
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-25416 - Elementor Plugin
Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through
PLUGIN
Elementor
CVE-2026-25416
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-25392 - Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress Plugin
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in KaizenCoders Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress update-urls allows Phishing.This issue affects Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress: from n/a through
PLUGIN
Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress
CVE-2026-25392
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-25386 - Ally Plugin
Missing Authorization vulnerability in Elementor Ally pojo-accessibility allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ally: from n/a through
PLUGIN
Ally
CVE-2026-25386
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-25387 - Image Optimizer by Elementor Plugin
Missing Authorization vulnerability in Elementor Image Optimizer by Elementor image-optimization allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Optimizer by Elementor: from n/a through
PLUGIN
Image Optimizer by Elementor
CVE-2026-25387
Risk Score