Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-01
CVE-2026-57329 - WordPress component
Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro
UNKNOWN
WordPress component
CVE-2026-57329
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-57328 - WordPress component
Subscriber Cross Site Scripting (XSS) in Business Directory
UNKNOWN
WordPress component
CVE-2026-57328
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-57327 - WordPress component
Subscriber Broken Access Control in MainWP
UNKNOWN
WordPress component
CVE-2026-57327
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-57326 - WordPress component
Unauthenticated Cross Site Scripting (XSS) in Business Directory
UNKNOWN
WordPress component
CVE-2026-57326
Risk Score
Threat Entry
Updated 2026-07-08
CVE-2026-57676 - Simple User Avatar Plugin
Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9.
PLUGIN
Simple User Avatar
CVE-2026-57676
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-9676 - F4 Post Tree Plugin
The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.
PLUGIN
F4 Post Tree
CVE-2026-9676
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-9242 - Custom Registration Form Builder With Submission Manager Plugin
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN `callback` handler being registered as a nopriv AJAX action with no authentication or nonce requirement, and critically because the handler updates the payment log database row with attacker-controlled POST data — including `payment_status` and the `custom` field encoding the target `user_id` — before PayPal IPN validation is performed, meaning…
PLUGIN
Custom Registration Form Builder With Submission Manager
CVE-2026-9242
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-9233 - Quiz Master Next Plugin
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table, including storing unsanitized HTML content such as arbitrary script tags.
PLUGIN
Quiz Master Next
CVE-2026-9233
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-3462 - Reepay Checkout Gateway Plugin
The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.
PLUGIN
Reepay Checkout Gateway
CVE-2026-3462
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-13295 - Siteorigin Panels Plugin
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including, 2.34.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the nonce and edit_post capability checks enforced during save are both satisfied by Contributor-level users for their own posts, and the panels_data value is…
PLUGIN
Siteorigin Panels
CVE-2026-13295
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-11783 - Dokan Lite Plugin
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Product SKU in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered to site visitors — including unauthenticated users — when the store search widget…
PLUGIN
Dokan Lite
CVE-2026-11783
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-12432 - Wp Full Stripe Free Plugin
The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs no capability check, no nonce verification, and no logged-in check before calling $this->db->updatePaymentByEventId() with attacker-controlled POST parameters. This makes it possible for unauthenticated attackers who can obtain a valid Stripe Payment Intent ID for the target site (Payment Intent IDs are exposed to the customer browser during normal Stripe.js…
PLUGIN
Wp Full Stripe Free
CVE-2026-12432
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-12399 - Gutenverse Plugin
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Gutenverse
CVE-2026-12399
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-12471 - Spexo Theme
The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set of plugins.
THEME
Spexo
CVE-2026-12471
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-11987 - Dokan Lite Plugin
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor's products — including unpublished draft and pending listings — exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection…
PLUGIN
Dokan Lite
CVE-2026-11987
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-11773 - Learning Management System Plugin
The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with student-level access and above, to modify the description (post content) of arbitrary course announcements authored by instructors or administrators.
PLUGIN
Learning Management System
CVE-2026-11773
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-11597 - Surbma Infusionsoft Shortcode Plugin
The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied 'account' and 'id' shortcode attributes in the surbma_infusionsoft_shortcode_shortcode() function, which are concatenated directly into a tag's src attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Surbma Infusionsoft Shortcode
CVE-2026-11597
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-11364 - Product Specifications Plugin
The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to and including 0.8.9. This is due to a missing capability check and missing nonce verification in the __invoke() methods of the AttributeGroupController and AttributeController classes, which are bound to the 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create, edit, and delete arbitrary product specification groups and attributes (taxonomy terms in the 'spec-group' and attribute taxonomies), corrupting business…
PLUGIN
Product Specifications
CVE-2026-11364
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-9677 - Shariff for WordPress Plugin
The Shariff for WordPress Shariff for WordPress plugin through 1.0.11 does not sanitize or escape the shariff_infourl setting before outputting it in the frontend HTML via the generateshariff() function, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Shariff for WordPress
CVE-2026-9677
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-13245 - Create Buttons Plugin
The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and including, 9.8.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Create Buttons
CVE-2026-13245
Risk Score