Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-02
CVE-2026-14249 - Request A Quote Plugin
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopriv with its only protection being a nonce that the plugin prints into the public quote-form page via wp_localize_script. This makes it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the…
PLUGIN
Request A Quote
CVE-2026-14249
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-57736 - HubSpot Plugin
Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.
PLUGIN
HubSpot
CVE-2026-57736
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-57723 - VikBooking Hotel Booking Engine & PMS Plugin
Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.
PLUGIN
VikBooking Hotel Booking Engine & PMS
CVE-2026-57723
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-13228 - Calendar Booking Plugin For Appointments And Events
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Object Reference (IDOR) in the create_or_update() function of OsOrdersController, which allows an authenticated Agent to supply an arbitrary order[customer_id] and overwrite any LatePoint customer's email field (including one linked to a WordPress Administrator's account) through the public-scope customer set_data() call, combined with a missing role verification in OsAuthHelper::authorize_customer() which logs in the linked WordPress user without…
PLUGIN
Calendar Booking Plugin For Appointments And Events
CVE-2026-13228
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-12142 - Nex Forms Express Wp Form Builder Plugin
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '_name[]' Array Parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses() output filtering pass provides no mitigation because NEXForms_allowed_tags() explicitly permits <script>, <iframe src/srcdoc>, and JS event handlers such as onClick, onBlur, and onChange in its allow-list.
PLUGIN
Nex Forms Express Wp Form Builder
CVE-2026-12142
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-12224 - Dokan Pro Plugin
The Dokan Pro plugin for WordPress is vulnerable to privilege escalation via update_capabilities REST Endpoint in all versions up to, and including, 5.0.4. This is due to the `update_capabilities()` REST handler accepting arbitrary capability strings from the request body and passing them directly to WP_User::add_cap() with no allowlist validation, only verifying that the caller holds the dokandar capability. This makes it possible for authenticated attackers with a self-provisioned Vendor-level access and above, on sites with the Vendor Staff module enabled, to grant arbitrary WordPress capabilities, including administrator, to any vendor_staff…
PLUGIN
Dokan Pro
CVE-2026-12224
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-12158 - Custom Registration Form Builder With Submission Manager Plugin
The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.0.9.1. This is due to missing or incorrect nonce validation on the process_request function. This makes it possible for unauthenticated attackers to escalate the privileges of an arbitrary form submitter to administrator by creating a malicious Chronos automation task that is executed via WordPress cron via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Custom Registration Form Builder With Submission Manager
CVE-2026-12158
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-11794 - Before 2 Plugin
The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 configuration.
PLUGIN
Before 2
CVE-2026-11794
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-11823 - Bookingpress Appointment Booking Pro Plugin
The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmember_to_slots() function in versions up to and including 5.7.1. This is due to the explicit use of stripslashes_deep() on user-supplied POST data before it is interpolated verbatim into a SQL LIKE clause without use of $wpdb->prepare() or any parameterization. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Bookingpress Appointment Booking Pro
CVE-2026-11823
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-11568 - Product Configurator For Woocommerce Plugin
The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX action, allowing unauthenticated users to retrieve the data (title, price, weight, stock status, and configurator option pricing/SKUs) of private and draft, non-public products by supplying the product ID. WordPress post-visibility controls are bypassed.
PLUGIN
Product Configurator For Woocommerce
CVE-2026-11568
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-1239 - Contact Form Builder That Grows With You Plugin
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.
PLUGIN
Contact Form Builder That Grows With You
CVE-2026-1239
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-11883 - Webauthn Provider For Two Factor Plugin
The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.
PLUGIN
Webauthn Provider For Two Factor
CVE-2026-11883
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-10750 - Royal Mcp Plugin
The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication, allowing authenticated users with a low-privileged role such as Subscriber to read private content, enumerate all users and their roles, and create, modify, or delete content owned by other users.
PLUGIN
Royal Mcp
CVE-2026-10750
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-7517 - Custom Payment Gateways For Woocommerce Plugin
The Custom Payment Gateways for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'alg_wc_cpg_input_fields' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable by unauthenticated guest users submitting a crafted checkout POST request, requiring no custom input fields to be configured in the plugin.
PLUGIN
Custom Payment Gateways For Woocommerce
CVE-2026-7517
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-13468 - Charts Manager With Built In Ai Generator Plugin
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — including charts in draft, private, pending, future, or trash status — as CSV, Excel, or HTML via the /wp-json/visualizer/v1/action/{chart}/{type}/ REST endpoint. This bypass is…
PLUGIN
Charts Manager With Built In Ai Generator
CVE-2026-13468
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-12923 - Youtube Showcase Plugin
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP function name with no arguments via `$sess_name()`. The handler is gated only by a nonce — no current_user_can() check is present — and the nonce is emitted on any front-end page that renders a…
PLUGIN
Youtube Showcase
CVE-2026-12923
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-13731 - WPBot – AI ChatBot for Live Support, Lead Generation, AI Services Plugin
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous…
PLUGIN
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
CVE-2026-13731
Risk Score
Threat Entry
Updated 2026-07-01
CVE-2026-10513 - Webmention Plugin
The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' author metadata. This is due to insufficient input sanitization and output escaping on user-supplied MF2 author properties processed by the unauthenticated webmention REST endpoint and rendered directly into HTML 'value' attributes by the edit-comment-form template without esc_attr() or esc_url(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a privileged user (moderator or administrator) opens the affected comment…
PLUGIN
Webmention
CVE-2026-10513
Risk Score
Threat Entry
Updated 2026-06-30
CVE-2026-8141 - Ajax Load More Filters Plugin
The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Ajax Load More Filters
CVE-2026-8141
Risk Score
Threat Entry
Updated 2026-06-30
CVE-2026-11589 - Wp Support Plus Responsive Ticket System Plugin
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly validate uploaded files, allowing unauthenticated users to upload files containing malicious JavaScript (such as HTML or SVG) to a publicly accessible location, leading to Stored Cross-Site Scripting attacks against site users and administrators.
PLUGIN
Wp Support Plus Responsive Ticket System
CVE-2026-11589
Risk Score