Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-01
CVE-2026-13468 - Visualizer – Tables & Charts Manager with Built-in AI Generator Theme
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — including charts in draft, private, pending, future, or trash status — as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is…
THEME
Visualizer – Tables & Charts Manager with Built-in AI Generator
CVE-2026-13468
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-13443 - Tutor LMS – eLearning and online course solution Theme
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Tutor LMS – eLearning and online course solution
CVE-2026-13443
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-12471 - Spexo Theme
The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set of plugins.
THEME
Spexo
CVE-2026-12471
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-56028 - Easy Elements for Elementor – Addons & Website Templates Theme
Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates
THEME
Easy Elements for Elementor – Addons & Website Templates
CVE-2026-56028
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-12937 - Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin Theme
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler is registered for unauthenticated users via…
THEME
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin
CVE-2026-12937
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-3326 - Before 9 Theme
The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
THEME
Before 9
CVE-2026-3326
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-8365 - Blocksy Theme
The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '' and does not prevent serialized PHP object strings from being stored in post meta, combined with the SearchReplacer::run_recursively() function unconditionally deserializing all string values via @unserialize() during migration without restricting allowed classes. This makes it possible for authenticated attackers,…
THEME
Blocksy
CVE-2026-8365
Risk Score
Threat Entry
Updated 2026-07-21
CVE-2026-9243 - The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Theme
The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the render() function, where the carousel_direction value is placed into an unquoted HTML attribute (dir=) allowing attribute injection despite the use of esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
CVE-2026-9243
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-6268 - Before 22 Theme
The EventPress WordPress theme before 22.2 does not sanitize or escape the 'id' parameter in the eventpress_customizer_notify_dismiss_action AJAX handler before outputting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against logged-in users.
THEME
Before 22
CVE-2026-6268
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-9018 - Easy Elements for Elementor – Addons & Website Templates Theme
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the `easyel_handle_register()` function. This is due to the `wp_ajax_nopriv_eel_register` AJAX handler iterating the attacker-controlled `custom_meta` POST array and writing every supplied key-value pair to the newly created user's meta via `update_user_meta()` without any key whitelist or blocklist, allowing the `wp_capabilities` user meta key to be overwritten after `wp_insert_user()` has already assigned a safe role. This makes it possible for unauthenticated attackers to register…
THEME
Easy Elements for Elementor – Addons & Website Templates
CVE-2026-9018
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2518 - Fastx Theme
The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback' and 'ultp_activate_callback' functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the PostX plugin.
THEME
Fastx
CVE-2026-2518
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-6279 - Avada (Fusion) Builder Theme
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowlist validation. This is exploitable by unauthenticated attackers through the `fusion_get_widget_markup` AJAX endpoint, which is registered for non-privileged (unauthenticated) users via `wp_ajax_nopriv_fusion_get_widget_markup`. The endpoint is protected only by a nonce (`fusion_load_nonce`), but this nonce is generated for user ID 0 and is deterministically…
THEME
Avada (Fusion) Builder
CVE-2026-6279
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1543 - Avada (Fusion) Builder Theme
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an administrator) accesses a page displaying dynamic user data (such as via the Dynamic Data feature pulling user biographical information).
THEME
Avada (Fusion) Builder
CVE-2026-1543
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-8423 - JaviBola Custom Theme Test
The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the options page. This makes it possible for unauthenticated attackers to change the site's active theme by modifying the jbct_theme option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
THEME
JaviBola Custom Theme Test
CVE-2026-8423
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-7284 - Easy Elements for Elementor – Addons & Website Templates Theme
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
THEME
Easy Elements for Elementor – Addons & Website Templates
CVE-2026-7284
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-8073 - Kirki – Freeform Page Builder, Website Builder & Customizer Theme
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory.
THEME
Kirki – Freeform Page Builder, Website Builder & Customizer
CVE-2026-8073
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-8096 - Kirki – Freeform Page Builder, Website Builder & Customizer Theme
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.
THEME
Kirki – Freeform Page Builder, Website Builder & Customizer
CVE-2026-8096
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-6646 - The7 — Website and eCommerce Builder for WordPress Theme
The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dt_default_button' shortcode in all versions up to, and including, 14.3.2. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
The7 — Website and eCommerce Builder for WordPress
CVE-2026-6646
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-6261 - Betheme
The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files (including PHP) and achieve remote code execution via the Icons icon-pack upload flow.
THEME
Betheme
CVE-2026-6261
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-6262 - Betheme
The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user-controlled upload path (`mfn-icon-upload`) in a filesystem move operation without constraining it to the uploads directory. This makes it possible for authenticated attackers, with contributor-level access and above, to move/delete arbitrary local files via path traversal.
THEME
Betheme
CVE-2026-6262
Risk Score