Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-01-27
CVE-2026-22391 - Cocco Plugin
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Cocco cocco allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cocco: from n/a through
PLUGIN
Cocco
CVE-2026-22391
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-22382 - PawFriends - Pet Shop and Veterinary WordPress Theme
Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through
THEME
PawFriends - Pet Shop and Veterinary WordPress Theme
CVE-2026-22382
Risk Score
Threat Entry
Updated 2026-01-27
CVE-2026-22360 - SearchAzon Plugin
Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This issue affects SearchAzon: from n/a through
PLUGIN
SearchAzon
CVE-2026-22360
Risk Score
Threat Entry
Updated 2026-01-27
CVE-2026-22353 - teachPress Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winkm89 teachPress teachpress allows Stored XSS.This issue affects teachPress: from n/a through
PLUGIN
teachPress
CVE-2026-22353
Risk Score
Threat Entry
Updated 2026-01-27
CVE-2026-22347 - Carousel Horizontal Posts Content Slider Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in subhansanjaya Carousel Horizontal Posts Content Slider carousel-horizontal-posts-content-slider allows DOM-Based XSS.This issue affects Carousel Horizontal Posts Content Slider: from n/a through
PLUGIN
Carousel Horizontal Posts Content Slider
CVE-2026-22347
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-22358 - Electrician - Electrical Service WordPress Plugin
Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Electrician - Electrical Service WordPress electrician allows Server Side Request Forgery.This issue affects Electrician - Electrical Service WordPress: from n/a through
PLUGIN
Electrician - Electrical Service WordPress
CVE-2026-22358
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2026-22349 - Menu In Post Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linux4me2 Menu In Post menu-in-post allows DOM-Based XSS.This issue affects Menu In Post: from n/a through
PLUGIN
Menu In Post
CVE-2026-22349
Risk Score
Threat Entry
Updated 2026-01-27
CVE-2026-22348 - Civic Cookie Control Plugin
Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Civic Cookie Control: from n/a through
PLUGIN
Civic Cookie Control
CVE-2026-22348
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-22359 - Wordpress Movies Bulk Importer Plugin
Cross-Site Request Forgery (CSRF) vulnerability in AA-Team Wordpress Movies Bulk Importer movies importer allows Cross Site Request Forgery.This issue affects Wordpress Movies Bulk Importer: from n/a through
PLUGIN
Wordpress Movies Bulk Importer
CVE-2026-22359
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-53240 - WordPress Core
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamlabs WordPress Photo Gallery photo-gallery-portfolio allows Reflected XSS.This issue affects WordPress Photo Gallery: from n/a through
CORE
WordPress Core
CVE-2025-53240
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-49043 - WordPress Core
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic_carousel allows Reflected XSS.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a through
CORE
WordPress Core
CVE-2025-49043
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1036 - Photo Gallery Plugin
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1.8.36. This makes it possible for unauthenticated attackers to delete arbitrary image comments. Note: comments functionality is only available in the Pro version of the plugin.
PLUGIN
Photo Gallery
CVE-2026-1036
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-0690 - Adsense And Custom Code Plugin
The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rank_math_description' custom field in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Adsense And Custom Code
CVE-2026-0690
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-0608 - Head Meta Data Plugin
The Head Meta Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'head-meta-data' post meta field in all versions up to, and including, 20251118 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Head Meta Data
CVE-2026-0608
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-0548 - Tutor LMS – eLearning and online course solution Theme
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.
THEME
Tutor LMS – eLearning and online course solution
CVE-2026-0548
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-0554 - NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar Plugin
The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' REST API endpoints in all versions up to, and including, 3.1.11. This makes it possible for authenticated attackers, with Contributor-level access and above, to reset analytics for any NotificationX campaign, regardless of ownership.
PLUGIN
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
CVE-2026-0554
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-15043 - The Events Calendar Plugin
The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration', and 'revert_migration' functions in all versions up to, and including, 6.15.13. This makes it possible for authenticated attackers, with subscriber level access and above, to start, cancel, or revert the Custom Tables V1 database migration, including dropping the custom database tables entirely via the revert action.
PLUGIN
The Events Calendar
CVE-2025-15043
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2025-12573 - Allowing Low Privileged Users To Delete Bookingor Plugin
The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress plugin through 1.0.12 data.
PLUGIN
Allowing Low Privileged Users To Delete Bookingor
CVE-2025-12573
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1045 - Viet Contact Plugin
The Viet contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Viet Contact
CVE-2026-1045
Risk Score
Threat Entry
Updated 2026-04-15
CVE-2026-1042 - Wp Hello Bar Plugin
The WP Hello Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'digit_one' and 'digit_two' parameters in all versions up to, and including, 1.02 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Hello Bar
CVE-2026-1042
Risk Score