Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-02-19
CVE-2025-12116 - Drift Theme
The Drift theme for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Drift
CVE-2025-12116
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-2386 - The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Theme
The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpae_create_page() AJAX handler authorizing users only with current_user_can('edit_posts') while accepting a user-controlled 'post_type' value passed directly to wp_insert_post() without post-type-specific capability checks. This makes it possible for authenticated attackers, with Author-level access and above, to create arbitrary draft posts for restricted post types (e.g., 'page' and 'nxt_builder') via the 'post_type' parameter.
THEME
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
CVE-2026-2386
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-2019 - Cart All In One For WooCommerce Theme
The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This is due to insufficient input validation on the 'Assign page' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server.
THEME
Cart All In One For WooCommerce
CVE-2026-2019
Risk Score
Threat Entry
Updated 2026-02-18
CVE-2025-12074 - Context Blog Theme
The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
THEME
Context Blog
CVE-2025-12074
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1793 - Element Pack Addons for Elementor Theme
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 8.3.17 via the SVG widget and a lack of sufficient file validation in the 'render_svg' function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
THEME
Element Pack Addons for Elementor
CVE-2026-1793
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1729 - Adforest Theme
The AdForest theme for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.0.12. This is due to the plugin not properly verifying a user's identity prior to authenticating them through the 'sb_login_user_with_otp_fun' function. This makes it possible for unauthenticated attackers to log in as arbitrary users, including administrators.
THEME
Adforest
CVE-2026-1729
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1319 - Robin Image Optimizer – Unlimited Image Optimization & WebP Converter Theme
The Robin Image Optimizer – Unlimited Image Optimization & WebP Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of a Media Library image in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Robin Image Optimizer – Unlimited Image Optimization & WebP Converter
CVE-2026-1319
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-0867 - Essential Widgets Theme
The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category, ew-page, and ew-menu shortcodes in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 3.0.
THEME
Essential Widgets
CVE-2026-0867
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1755 - Menu Icons by ThemeIsle
The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_wp_attachment_image_alt’ post meta in all versions up to, and including, 0.13.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Menu Icons by ThemeIsle
CVE-2026-1755
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1375 - Tutor LMS – eLearning and online course solution Theme
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
THEME
Tutor LMS – eLearning and online course solution
CVE-2026-1375
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1371 - Tutor LMS – eLearning and online course solution Theme
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.
THEME
Tutor LMS – eLearning and online course solution
CVE-2026-1371
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1097 - ThemeRuby Multi Authors – Assign Multiple Writers to Posts
The ThemeRuby Multi Authors – Assign Multiple Writers to Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' shortcode attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
ThemeRuby Multi Authors – Assign Multiple Writers to Posts
CVE-2026-1097
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1095 - Canto Testimonials Theme
The Canto Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fx' shortcode attribute in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Canto Testimonials
CVE-2026-1095
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-22382 - PawFriends - Pet Shop and Veterinary WordPress Theme
Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through
THEME
PawFriends - Pet Shop and Veterinary WordPress Theme
CVE-2026-22382
Risk Score
Threat Entry
Updated 2026-01-28
CVE-2025-69004 - Bajaar Allows Php Local File Inclusion Theme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in XpeedStudio Bajaar - Highly Customizable WooCommerce WordPress Theme bajaar allows PHP Local File Inclusion.This issue affects Bajaar - Highly Customizable WooCommerce WordPress Theme: from n/a through
THEME
Bajaar Allows Php Local File Inclusion
CVE-2025-69004
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-0726 - Nexter Extension – Security, Performance, Code Snippets & Site Toolkit Theme
The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.6 via deserialization of untrusted input in the 'nxt_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on…
THEME
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
CVE-2026-0726
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-0548 - Tutor LMS – eLearning and online course solution Theme
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.
THEME
Tutor LMS – eLearning and online course solution
CVE-2026-0548
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-0808 - Spin Wheel – Interactive spinning wheel that offers coupons Theme
The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate which prize they win by modifying the 'prize_index' parameter sent to the server, allowing them to always select the most valuable prizes.
THEME
Spin Wheel – Interactive spinning wheel that offers coupons
CVE-2026-0808
Risk Score
Threat Entry
Updated 2026-01-16
CVE-2025-12895 - Woocommerce Theme
The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it possible for unauthenticated attackers to use the theme an an open mail relay and send email to arbitrary email addresses on the server's behalf.
THEME
Woocommerce Theme
CVE-2025-12895
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2025-10915 - Dreamer Blog Theme
The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.
THEME
Dreamer Blog
CVE-2025-10915
Risk Score