Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-04
E-cab Taxi Booking Manager for Woocommerce - Security Vulnerability (CVE-2026-84045)
The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-price value on the server before pricing a booking, allowing unauthenticated attackers to manipulate the order total down to zero and place real taxi-booking orders at an arbitrary price.
PLUGIN
E-cab Taxi Booking Manager for Woocommerce
CVE-2026-84045
Risk Score
Threat Entry
Updated 2026-09-04
JetPopup - Security Vulnerability (CVE-2026-27347)
Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopup: from n/a through 2.0.20.2.
PLUGIN
JetPopup
CVE-2026-27347
Risk Score
Threat Entry
Updated 2026-09-04
Restaurant Menu and Food Ordering - Security Vulnerability (CVE-2026-84044)
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.
PLUGIN
Restaurant Menu and Food Ordering
CVE-2026-84044
Risk Score
Threat Entry
Updated 2026-09-04
ePayco Payment Gateway for WooCommerce - Security Vulnerability (CVE-2026-84043)
The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature.
PLUGIN
ePayco Payment Gateway for WooCommerce
CVE-2026-84043
Risk Score
Threat Entry
Updated 2026-09-04
WoodMart - Security Vulnerability (CVE-2026-27086)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8.
PLUGIN
WoodMart
CVE-2026-27086
Risk Score
Threat Entry
Updated 2026-09-04
MarketKing - Security Vulnerability (CVE-2026-85311)
Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60.
PLUGIN
MarketKing
CVE-2026-85311
Risk Score
Threat Entry
Updated 2026-09-04
WP Rentals - Security Vulnerability (CVE-2026-27432)
Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0.
PLUGIN
WP Rentals
CVE-2026-27432
Risk Score
Threat Entry
Updated 2026-09-04
WCFM Membership - Security Vulnerability (CVE-2026-32480)
Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11.
PLUGIN
WCFM Membership
CVE-2026-32480
Risk Score
Threat Entry
Updated 2026-09-04
Xpro Addons - Security Vulnerability (CVE-2026-84146)
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).
PLUGIN
Xpro Addons
CVE-2026-84146
Risk Score
Threat Entry
Updated 2026-09-04
Frontend Admin by DynamiApps - Security Vulnerability (CVE-2026-81347)
The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.
PLUGIN
Frontend Admin by DynamiApps
CVE-2026-81347
Risk Score
Threat Entry
Updated 2026-09-04
3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms - Security Vulnerability (CVE-2026-80438)
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must…
PLUGIN
3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms
CVE-2026-80438
Risk Score
Threat Entry
Updated 2026-09-04
WPvivid - Security Vulnerability (CVE-2026-82194)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.
PLUGIN
WPvivid
CVE-2026-82194
Risk Score
Threat Entry
Updated 2026-09-04
WPvivid - Security Vulnerability (CVE-2026-82193)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.
PLUGIN
WPvivid
CVE-2026-82193
Risk Score
Threat Entry
Updated 2026-09-04
WPFunnels - Security Vulnerability (CVE-2026-79632)
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
PLUGIN
WPFunnels
CVE-2026-79632
Risk Score
Threat Entry
Updated 2026-09-04
WPLP Cookie Consent - Security Vulnerability (CVE-2026-82186)
The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.
PLUGIN
WPLP Cookie Consent
CVE-2026-82186
Risk Score
Threat Entry
Updated 2026-09-04
Pods - Security Vulnerability (CVE-2026-74853)
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
PLUGIN
Pods
CVE-2026-74853
Risk Score
Threat Entry
Updated 2026-09-04
WPFunnels - Security Vulnerability (CVE-2026-79631)
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
PLUGIN
WPFunnels
CVE-2026-79631
Risk Score
Threat Entry
Updated 2026-09-04
WPFunnels - Security Vulnerability (CVE-2026-79630)
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
PLUGIN
WPFunnels
CVE-2026-79630
Risk Score
Threat Entry
Updated 2026-09-04
Content Views - Security Vulnerability (CVE-2026-17517)
The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
PLUGIN
Content Views
CVE-2026-17517
Risk Score
Threat Entry
Updated 2026-09-03
Learnpress - Security Vulnerability (CVE-2026-82023)
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.
PLUGIN
Learnpress
CVE-2026-82023
Risk Score