Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-18
CVE-2026-11402 - Services Section Plugin
The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Attribute in all versions up to, and including, 1.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists inside HTML comments in post_content, bypassing wp_kses_post sanitization at save time, and executes via both the primary…
PLUGIN
Services Section
CVE-2026-11402
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-12120 - Increase Sales And Grow Your Email List Plugin
The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via the 'form_id' parameter. This makes it possible for unauthenticated attackers to extract download a full CSV export of all form submissions — including any personally identifiable information submitted by users — for any arbitrary form_id.
PLUGIN
Increase Sales And Grow Your Email List
CVE-2026-12120
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-12093 - Simple Membership Plugin
The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to deactivate arbitrary member accounts by forging a charge.refunded webhook event containing a victim's subscription ID, setting the target member's account_state to 'inactive' and triggering cancellation hooks, transaction-record status changes, and cancellation notification emails. This vulnerability is exploitable only on installations where no Stripe webhook signing…
PLUGIN
Simple Membership
CVE-2026-12093
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-11777 - Form Maker Plugin
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Form Maker
CVE-2026-11777
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-11776 - Form Maker Plugin
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' parameter in all versions up to, and including, 1.15.43 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Form Maker
CVE-2026-11776
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-11784 - Optimole Wp Plugin
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site…
PLUGIN
Optimole Wp
CVE-2026-11784
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-11360 - Woo Order Export Lite Plugin
The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_direction' parameter in all versions up to, and including, 4.0.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The endpoint requires a valid woe_nonce and Shop Manager-level capabilities (view_woocommerce_reports…
PLUGIN
Woo Order Export Lite
CVE-2026-11360
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-10736 - Elearning And Online Course Solution Plugin
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Elearning And Online Course Solution
CVE-2026-10736
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-11358 - Themeisle Companion Plugin
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Themeisle Companion
CVE-2026-11358
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-11357 - Kadence Blocks Plugin
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 via the editor_assets_variables. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the site's connected Kadence account license key, license owner email, api_key, api_email, and license domain from the browser console by inspecting window.kadence_blocks_params.proData. Exploitation requires only that an administrator has previously connected a valid Kadence license; the full credential bundle is then readable by any Contributor-level user…
PLUGIN
Kadence Blocks
CVE-2026-11357
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-10623 - Pressprimer Quiz Plugin
The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.3.0 via the 'rule_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to modify or delete quiz rules belonging to other teachers, resulting in unauthorized tampering of another user's quiz structure.
PLUGIN
Pressprimer Quiz
CVE-2026-10623
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-10029 - Eventkoi Lite Plugin
The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.13.1 via the get_events. This makes it possible for unauthenticated attackers to extract sensitive data including virtual meeting URLs, physical location data, latitude/longitude coordinates, Google Maps links, and RSVP configuration belonging to draft, pending, and private events that are otherwise inaccessible via public URLs.
PLUGIN
Eventkoi Lite
CVE-2026-10029
Risk Score
Threat Entry
Updated 2026-06-18
CVE-2026-10023 - Dokan Lite Plugin
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via the change_order_status, add_order_note, delete_order_note, add_shipping_tracking_info, grant_access_to_download, and revoke_access_to_download AJAX handlers due to missing ownership validation on a user-controlled order ID key. This makes it possible for authenticated attackers, with custom vendor-level access and above, to modify the status of arbitrary orders, add attacker-controlled notes to any order (including customer-facing notes that trigger WooCommerce notification emails to…
PLUGIN
Dokan Lite
CVE-2026-10023
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-54817 - MStore API Plugin
Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.
PLUGIN
MStore API
CVE-2026-54817
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-52716 - WordPress component
Unauthenticated Arbitrary File Deletion in WorkScout-Core
UNKNOWN
WordPress component
CVE-2026-52716
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-8607 - Mycred Plugin
The Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wrap' Shortcode Attribute in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Mycred
CVE-2026-8607
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-8494 - Permalink Manager Plugin
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in the admin URI Editor interface in all versions up to, and including, 2.5.3.3 due to insufficient output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in the admin Permalink Manager page that will execute whenever an administrator accesses the Permalink Manager page.
PLUGIN
Permalink Manager
CVE-2026-8494
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-8383 - Before 4 Plugin
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request
PLUGIN
Before 4
CVE-2026-8383
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-7850 - Wp Magnific Popup Plugin
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.
PLUGIN
Wp Magnific Popup
CVE-2026-7850
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-54196 - WordPress component
Subscriber Privilege Escalation in JetFormBuilder
UNKNOWN
WordPress component
CVE-2026-54196
Risk Score