Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-01-26
CVE-2026-22401 - Freshio Plugin
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Freshio freshio allows PHP Local File Inclusion.This issue affects Freshio: from n/a through
PLUGIN
Freshio
CVE-2026-22401
Risk Score
Threat Entry
Updated 2026-01-27
CVE-2026-22355 - Simple XML Sitemap Plugin
Cross-Site Request Forgery (CSRF) vulnerability in gregmolnar Simple XML Sitemap simple-xml-sitemap allows Stored XSS.This issue affects Simple XML Sitemap: from n/a through
PLUGIN
Simple XML Sitemap
CVE-2026-22355
Risk Score
Threat Entry
Updated 2026-01-28
CVE-2025-69004 - Bajaar Allows Php Local File Inclusion Theme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in XpeedStudio Bajaar - Highly Customizable WooCommerce WordPress Theme bajaar allows PHP Local File Inclusion.This issue affects Bajaar - Highly Customizable WooCommerce WordPress Theme: from n/a through
THEME
Bajaar Allows Php Local File Inclusion
CVE-2025-69004
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-0726 - Nexter Extension – Security, Performance, Code Snippets & Site Toolkit Theme
The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.6 via deserialization of untrusted input in the 'nxt_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on…
THEME
Nexter Extension – Security, Performance, Code Snippets & Site Toolkit
CVE-2026-0726
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-15347 - And Trainers Plugin
The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check in the get_items_permissions_check function in all versions up to, and including, 1.1.12. This makes it possible for authenticated attackers, with contributor level access and above, to update arbitrary WordPress options.
PLUGIN
And Trainers
CVE-2025-15347
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-15380 - Floating Notification Bar Plugin
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'nx-preview' POST parameter in all versions up to, and including, 3.2.0. This is due to insufficient input sanitization and output escaping when processing preview data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute when a user visits a malicious page that auto-submits a form to the vulnerable site.
PLUGIN
Floating Notification Bar
CVE-2025-15380
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-14977 - Dokan Lite Plugin
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.2.4 via the `/wp-json/dokan/v1/settings` REST API endpoint due to missing validation on a user-controlled key. This makes it possible for authenticated attackers, with customer-level permissions and above, to read or modify other vendors' store settings including sensitive payment information (PayPal email, bank account details, routing numbers, IBAN, SWIFT codes), phone numbers, and addresses, and change PayPal email addresses to…
PLUGIN
Dokan Lite
CVE-2025-14977
Risk Score
Threat Entry
Updated 2026-03-09
CVE-2026-22850 - Koko Analytics Is An Open Source Analytics Plugin
Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import. Unauthenticated visitors can submit arbitrary path (`pa`) and referrer (`r`) values to the public tracking endpoint in src/Resources/functions/collect.php, which stores those strings verbatim in the analytics tables. The admin export logic in src/Admin/Data_Export.php writes these stored values directly into SQL INSERT statements without escaping. A crafted path such as "),('999','x');DROP TABLE wp_users;-- breaks out of the value list. When an administrator later…
PLUGIN
Koko Analytics Is An Open Source Analytics
CVE-2026-22850
Risk Score
Threat Entry
Updated 2026-02-18
CVE-2026-23644 - esm.sh Plugin
esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerability due to an incomplete fix. `path.Clean` normalizes a path but does not prevent absolute paths in a malicious tar file. Commit https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16, corresponding to pseudoversion 0.0.0-20260116051925-c62ab83c589e, fixes this issue.
PLUGIN
esm.sh
CVE-2026-23644
Risk Score
Threat Entry
Updated 2026-02-10
CVE-2026-0863 - N8n Plugin
Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissions and can lead to a full n8n instance takeover on instances operating under "Internal" execution mode. If the instance is operating under the "External" execution mode (ex. n8n's official Docker image) - arbitrary code execution occurs inside a Sidecar container and not the main node, which significantly reduces the…
PLUGIN
N8n
CVE-2026-0863
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-14478 - Demo Importer Plus Plugin
The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file upload functionality. This makes it possible for authenticated attackers, with Author-level access and above, to achieve code execution in vulnerable configurations. This only impacts sites on versions of PHP older than 8.0.
PLUGIN
Demo Importer Plus
CVE-2025-14478
Risk Score
Threat Entry
Updated 2026-02-18
CVE-2026-22865 - Gradle Plugin
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. An exception like NoHttpResponseException can indicate transient errors. If the errors persist after a maximum number of retries, Gradle would continue to the next…
PLUGIN
Gradle
CVE-2026-22865
Risk Score
Threat Entry
Updated 2026-02-18
CVE-2026-22816 - Gradle Plugin
Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, some exceptions were not treated as fatal errors and would not cause a repository to be disabled. If a build encountered one of these exceptions, Gradle would continue to the next repository in the list and potentially resolve dependencies from a different repository. If a Gradle build used an unresolvable host name, Gradle would continue to work as long as all dependencies could be resolved from another…
PLUGIN
Gradle
CVE-2026-22816
Risk Score
Threat Entry
Updated 2026-02-18
CVE-2026-23745 - Node Tar Plugin
node-tar is a Tar for Node.js. The node-tar library (
PLUGIN
Node Tar
CVE-2026-23745
Risk Score
Threat Entry
Updated 2026-02-12
CVE-2026-20960 - Microsoft Power Apps Desktop Client Plugin
Improper authorization in Microsoft Power Apps allows an authorized attacker to execute code over a network.
PLUGIN
Microsoft Power Apps Desktop Client
CVE-2026-20960
Risk Score
Threat Entry
Updated 2026-02-22
CVE-2026-21223 - Microsoft Edge (Chromium-based) Plugin
Improper privilege management in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.
PLUGIN
Microsoft Edge (Chromium-based)
CVE-2026-21223
Risk Score
Threat Entry
Updated 2026-02-18
CVE-2026-23742 - Skipper Plugin
Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0.
PLUGIN
Skipper
CVE-2026-23742
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2026-23735 - Graphql Modules Plugin
GraphQL Modules is a toolset of libraries and guidelines dedicated to create reusable, maintainable, testable and extendable modules out of your GraphQL server. From 2.2.1 to before 2.4.1 and 3.1.1, when 2 or more parallel requests are made which trigger the same service, the context of the requests is mixed up in the service when the context is injected via @ExecutionContext(). ExecutionContext is often used to pass authentication tokens from incoming requests to services loading data from backend APIs. This vulnerability is fixed in 2.4.1 and 3.1.1.
PLUGIN
Graphql Modules
CVE-2026-23735
Risk Score
Threat Entry
Updated 2026-01-30
CVE-2026-23723 - WeGIA Plugin
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.
PLUGIN
WeGIA
CVE-2026-23723
Risk Score
Threat Entry
Updated 2026-02-18
CVE-2026-23535 - Wlc Plugin
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.
PLUGIN
Wlc
CVE-2026-23535
Risk Score