Threat Entry Updated 2026-06-29

CVE-2026-12415 - Invoice Creator Plugin

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.

PLUGIN Invoice Creator

CVE-2026-12415

CRITICAL CVSS 9.8 2026-06-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-57658 - WordPress component

Administrator Arbitrary File Upload in TemplateSpare

UNKNOWN WordPress component

CVE-2026-57658

CRITICAL CVSS 9.1 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56070 - WordPress component

Unauthenticated SQL Injection in Advance Product Search

UNKNOWN WordPress component

CVE-2026-56070

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-29

CVE-2026-56068 - WordPress component

Unauthenticated SQL Injection in JetEngine

UNKNOWN WordPress component

CVE-2026-56068

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56067 - WordPress component

Unauthenticated SQL Injection in JetSmartFilters

UNKNOWN WordPress component

CVE-2026-56067

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56059 - WordPress component

Subscriber Arbitrary File Upload in Travel Booking

UNKNOWN WordPress component

CVE-2026-56059

CRITICAL CVSS 9.9 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56058 - WordPress component

Subscriber Arbitrary File Upload in Quform

UNKNOWN WordPress component

CVE-2026-56058

CRITICAL CVSS 9.9 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56057 - WordPress component

Subscriber PHP Object Injection in Uncanny Automator Pro

UNKNOWN WordPress component

CVE-2026-56057

CRITICAL CVSS 9.8 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56062 - WordPress component

Unauthenticated SQL Injection in Quotes llama

UNKNOWN WordPress component

CVE-2026-56062

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56033 - WordPress component

Unauthenticated Privilege Escalation in Dokan Pro

UNKNOWN WordPress component

CVE-2026-56033

CRITICAL CVSS 9.8 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56032 - WordPress component

Subscriber PHP Object Injection in Buddyboss Platform

UNKNOWN WordPress component

CVE-2026-56032

CRITICAL CVSS 9.8 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56036 - WordPress component

Unauthenticated SQL Injection in 워드프레스 결제 심플페이

UNKNOWN WordPress component

CVE-2026-56036

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-29

CVE-2026-56034 - WordPress component

Unauthenticated SQL Injection in Library Management System

UNKNOWN WordPress component

CVE-2026-56034

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56027 - WordPress component

Customer Arbitrary File Upload in Booster for WooCommerce

UNKNOWN WordPress component

CVE-2026-56027

CRITICAL CVSS 9.9 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-56030 - WordPress component

Unauthenticated Privilege Escalation in Paytium

UNKNOWN WordPress component

CVE-2026-56030

CRITICAL CVSS 9.8 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-29

CVE-2026-56028 - Easy Elements for Elementor – Addons & Website Templates Theme

Unauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates

THEME Easy Elements for Elementor – Addons & Website Templates

CVE-2026-56028

CRITICAL CVSS 9.8 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-54831 - WordPress component

Unauthenticated SQL Injection in GeoDirectory

UNKNOWN WordPress component

CVE-2026-54831

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-54827 - WordPress component

Unauthenticated SQL Injection in Real Estate 7

UNKNOWN WordPress component

CVE-2026-54827

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-54825 - WordPress component

Unauthenticated SQL Injection in wpDataTables

UNKNOWN WordPress component

CVE-2026-54825

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-26

CVE-2026-54820 - WordPress component

Unauthenticated SQL Injection in JetBooking

UNKNOWN WordPress component

CVE-2026-54820

CRITICAL CVSS 9.3 2026-06-26

Risk Score

Open Full Technical Breakdown