Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-16
CVE-2026-15350 - The Cache Purger Plugin
The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently truncate the plugin's cache-purge audit log (wp-content/purge.log), destroying the entire cache-purge audit history. The tcp_log_purge nonce is rendered in the admin bar on frontend pages accessible to all authenticated users including subscribers, meaning any authenticated user possesses the…
PLUGIN
The Cache Purger
CVE-2026-15350
Risk Score
Threat Entry
Updated 2026-07-18
CVE-2026-15022 - Elearning And Online Course Solution Plugin
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The payload is stored at quiz-attempt time via…
PLUGIN
Elearning And Online Course Solution
CVE-2026-15022
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-15099 - Delicious Recipes Plugin
The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrap_direction_text() function, which interpolates the user-supplied href value from nested link nodes ($node['props']['href']) directly into an anchor tag via sprintf() at line 1627 without esc_url() or any URL scheme validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts (including javascript: URIs) in pages that will…
PLUGIN
Delicious Recipes
CVE-2026-15099
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-15021 - Wpforo Forum Plugin
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'location' Profile Field in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field() function applied at input does not encode double quotes, allowing attribute breakout via a payload that escapes the href attribute context and injects event handler attributes.
PLUGIN
Wpforo Forum
CVE-2026-15021
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-15106 - Chatbot Plugin
The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to delete arbitrary chat session records from the wpbot_user and wpbot_conversation tables, including chat history and conversation logs, by supplying a crafted userid value.
PLUGIN
Chatbot
CVE-2026-15106
Risk Score
Threat Entry
Updated 2026-07-17
CVE-2026-15324 - Customize My Account For Woocommerce Plugin
The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'row_type' parameter in all versions up to, and including, 4.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Customize My Account For Woocommerce
CVE-2026-15324
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-13767 - Quiz Master Next Plugin
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsm_ajax_save_pages() AJAX handler (sanitize_text_field only) and lack of sufficient preparation on the existing SQL query built in qsm_options_questions_tab_content() at line 143, where the stored page IDs are interpolated into an IN() clause via implode() with no $wpdb->prepare() and no integer casting. This makes it possible for authenticated attackers, with Author-level access and…
PLUGIN
Quiz Master Next
CVE-2026-13767
Risk Score
Threat Entry
Updated 2026-07-18
CVE-2026-13754 - Tickera Event Ticketing System Plugin
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 3.6.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Tickera Event Ticketing System
CVE-2026-13754
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-13755 - Tickera Event Ticketing System Plugin
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute in all versions up to, and including, 3.6.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution of the injected script is limited to victims who have the referenced ticket ID present in their cart cookie, meaning the payload…
PLUGIN
Tickera Event Ticketing System
CVE-2026-13755
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-12684 - Customer Reviews For Woocommerce Plugin
The Customer Reviews for WooCommerce WordPress plugin before 5.113.0 does not perform authentication, capability, or nonce checks on one of its media upload AJAX actions when the review media attachment feature is enabled, allowing unauthenticated users to upload media files (bounded to an image and video allowlist) to the Media Library and create attachment posts, leading to media library pollution and disk space exhaustion.
PLUGIN
Customer Reviews For Woocommerce
CVE-2026-12684
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-12869 - Header Footer Builder For Elementor Plugin
The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard template-import action (it allows any edit_posts user), so a Contributor can import a template containing an Elementor HTML widget configured to display site-wide, injecting JavaScript that executes in the session of any visitor or administrator who loads the site.
PLUGIN
Header Footer Builder For Elementor
CVE-2026-12869
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-12979 - Which Can Disable Other Funnelkit Plugin
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).
PLUGIN
Which Can Disable Other Funnelkit
CVE-2026-12979
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-12395 - Wp Job Portal Plugin
The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with a subscriber-level (self-registerable) account to perform SQL injection attacks.
PLUGIN
Wp Job Portal
CVE-2026-12395
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-11371 - Before 4 Plugin
The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browser of any visitor who views the affected page, including administrators.
PLUGIN
Before 4
CVE-2026-11371
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-12510 - Ai Engine Plugin
The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.
PLUGIN
Ai Engine
CVE-2026-12510
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-11866 - Appointment Booking Plugin
The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.
PLUGIN
Appointment Booking
CVE-2026-11866
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-15306 - Best Woocommerce Feed Plugin
The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Best Woocommerce Feed
CVE-2026-15306
Risk Score
Threat Entry
Updated 2026-07-17
CVE-2026-15458 - Seo Booster Plugin
The SEO Booster plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_field' parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Seo Booster
CVE-2026-15458
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-15445 - Seo Booster Plugin
The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Although esc_sql() and sanitize_text_field() are applied, neither neutralizes SQL keywords, commas, parentheses, or subquery syntax…
PLUGIN
Seo Booster
CVE-2026-15445
Risk Score
Threat Entry
Updated 2026-07-16
CVE-2026-15652 - Easy Accordion Free Plugin
The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'align' Block Attribute in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Easy Accordion Free
CVE-2026-15652
Risk Score