Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-04-15
CVE-2026-0572 - Webpurify Profanity Filter Plugin
The WebPurify Profanity Filter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'webpurify_save_options' function in all versions up to, and including, 4.0.2. This makes it possible for unauthenticated attackers to change plugin settings.
PLUGIN
Webpurify Profanity Filter
CVE-2026-0572
Risk Score
Threat Entry
Updated 2026-02-04
CVE-2025-15508 - Magic Import Document Extractor Plugin
The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the get_frontend_settings() function. This makes it possible for unauthenticated attackers to extract the site's magicimport.ai license key from the page source on any page containing the plugin's shortcode.
PLUGIN
Magic Import Document Extractor
CVE-2025-15508
Risk Score
Threat Entry
Updated 2026-02-04
CVE-2025-15507 - Magic Import Document Extractor Plugin
The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_usage() function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to modify the plugin's license status and credit balance.
PLUGIN
Magic Import Document Extractor
CVE-2025-15507
Risk Score
Threat Entry
Updated 2026-02-04
CVE-2025-15482 - Chapa Payment Gateway For Woocommerce Plugin
The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 via 'chapa_proceed' WooCommerce API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including the merchant's Chapa secret API key.
PLUGIN
Chapa Payment Gateway For Woocommerce
CVE-2025-15482
Risk Score
Threat Entry
Updated 2026-02-04
CVE-2025-15487 - Code Explorer Plugin
The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Code Explorer
CVE-2025-15487
Risk Score
Threat Entry
Updated 2026-02-04
CVE-2025-15260 - Loyalty Points And Rewards For Woocommerce Plugin
The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.
PLUGIN
Loyalty Points And Rewards For Woocommerce
CVE-2025-15260
Risk Score
Threat Entry
Updated 2026-02-04
CVE-2025-14461 - Woo Xendit Virtual Accounts Plugin
The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the plugin exposing a publicly accessible WooCommerce API callback endpoint (`wc_xendit_callback`) that processes payment callbacks without any authentication or cryptographic verification that the requests originate from Xendit's payment gateway. This makes it possible for unauthenticated attackers to mark any WooCommerce order as paid by sending a crafted POST request to the callback URL with a JSON body containing an `external_id` matching the order ID pattern…
PLUGIN
Woo Xendit Virtual Accounts
CVE-2025-14461
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1755 - Menu Icons by ThemeIsle
The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_wp_attachment_image_alt’ post meta in all versions up to, and including, 0.13.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Menu Icons by ThemeIsle
CVE-2026-1755
Risk Score
Threat Entry
Updated 2026-02-12
CVE-2026-25036 - Passster Plugin
Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through
PLUGIN
Passster
CVE-2026-25036
Risk Score
Threat Entry
Updated 2026-02-05
CVE-2026-25028 - Elementor Plugin
Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through
PLUGIN
Elementor
CVE-2026-25028
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2026-25024 - ThirstyAffiliates Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through
PLUGIN
ThirstyAffiliates
CVE-2026-25024
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2026-25021 - Mizan Demo Importer Plugin
Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mizan Demo Importer: from n/a through
PLUGIN
Mizan Demo Importer
CVE-2026-25021
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2026-25023 - Run Contests, Raffles, and Giveaways with ContestsWP Plugin
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker allows Retrieve Embedded Sensitive Data.This issue affects Run Contests, Raffles, and Giveaways with ContestsWP: from n/a through
PLUGIN
Run Contests, Raffles, and Giveaways with ContestsWP
CVE-2026-25023
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2026-25019 - Atarim Plugin
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through
PLUGIN
Atarim
CVE-2026-25019
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2026-25020 - WP Sync for Notion Plugin
Missing Authorization vulnerability in WP connect WP Sync for Notion wp-sync-for-notion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sync for Notion: from n/a through
PLUGIN
WP Sync for Notion
CVE-2026-25020
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2026-25012 - WP Bannerize Pro Plugin
Missing Authorization vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bannerize Pro: from n/a through
PLUGIN
WP Bannerize Pro
CVE-2026-25012
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2026-25010 - Share This Image Plugin
Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share This Image: from n/a through
PLUGIN
Share This Image
CVE-2026-25010
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-24998 - Hustle Plugin
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popup allows Retrieve Embedded Sensitive Data.This issue affects Hustle: from n/a through
PLUGIN
Hustle
CVE-2026-24998
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2026-25016 - Nelio Popups Plugin
Missing Authorization vulnerability in Nelio Software Nelio Popups nelio-popups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Popups: from n/a through
PLUGIN
Nelio Popups
CVE-2026-25016
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2026-25015 - UsersWP Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through
PLUGIN
UsersWP
CVE-2026-25015
Risk Score