Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-06
Wp Social - Security Vulnerability (CVE-2026-97344)
The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta Write in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to chain two steps: invoking the nonce-only dismiss_ajax_call endpoint (nonce accessible to Subscribers via any…
PLUGIN
Wp Social
CVE-2026-97344
Risk Score
Threat Entry
Updated 2026-10-06
Simple Membership - Security Vulnerability (CVE-2026-97337)
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched from SwpmInitTimeTasks::check_and_do_email_activation() on frontend init with no authentication, nonce, capability, or ownership check, and the recipient address used by SwpmRegistration::send_reg_email() is taken from an attacker-controlled $_POST['email'] parameter (overriding the member's registered address). This makes it possible for unauthenticated attackers to redirect an arbitrary pending member's activation email — and the follow-up 'registration complete' email containing the…
PLUGIN
Simple Membership
CVE-2026-97337
Risk Score
Threat Entry
Updated 2026-10-06
Strong Testimonials - Security Vulnerability (CVE-2026-96650)
The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has added custom text fields named 'platform' and 'platform_user_photo' to a public testimonial submission form, as the plugin does not reserve those internal metadata keys.
PLUGIN
Strong Testimonials
CVE-2026-96650
Risk Score
Threat Entry
Updated 2026-10-06
Pie Register - Security Vulnerability (CVE-2026-96962)
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.
PLUGIN
Pie Register
CVE-2026-96962
Risk Score
Threat Entry
Updated 2026-10-06
Serbian Transliteration - Security Vulnerability (CVE-2026-96575)
The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives WordPress comment save-time sanitization because the tags and attributes used (such as a[title] and code) are permitted by the core comment kses allow-list,…
PLUGIN
Serbian Transliteration
CVE-2026-96575
Risk Score
Threat Entry
Updated 2026-10-06
Wp Seopress - Security Vulnerability (CVE-2026-96564)
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'Track Authors' custom dimension to be configured in the plugin's Google Analytics 4 or Matomo settings, and the attacker must be able to publish public…
PLUGIN
Wp Seopress
CVE-2026-96564
Risk Score
Threat Entry
Updated 2026-10-06
Loco Translate - Security Vulnerability (CVE-2026-94239)
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.
PLUGIN
Loco Translate
CVE-2026-94239
Risk Score
Threat Entry
Updated 2026-10-06
Loco Translate - Security Vulnerability (CVE-2026-94238)
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.
PLUGIN
Loco Translate
CVE-2026-94238
Risk Score
Threat Entry
Updated 2026-10-06
Gd Rating System - Security Vulnerability (CVE-2026-93430)
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's <script class="gdrts-rating-data"> JSON block on every page rendering the rating item, making…
PLUGIN
Gd Rating System
CVE-2026-93430
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-92923)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users with a role as low as subscriber to perform blind SQL injection attacks and read arbitrary data from the database. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-92923
Risk Score
Threat Entry
Updated 2026-10-06
Mailchimp for WooCommerce - Security Vulnerability (CVE-2026-92437)
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart record identified from request-supplied data, allowing an unauthenticated attacker to modify or delete another customer's stored cart.
PLUGIN
Mailchimp for WooCommerce
CVE-2026-92437
Risk Score
Threat Entry
Updated 2026-10-06
Kubio AI Page Builder - Security Vulnerability (CVE-2026-88783)
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administrator reviewing the still-unapproved submission.
PLUGIN
Kubio AI Page Builder
CVE-2026-88783
Risk Score
Threat Entry
Updated 2026-10-06
SaveTo Wishlist Lite - Security Vulnerability (CVE-2026-89236)
The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.
PLUGIN
SaveTo Wishlist Lite
CVE-2026-89236
Risk Score
Threat Entry
Updated 2026-10-06
TillKit - Security Vulnerability (CVE-2026-91078)
The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal data and modify store data.
PLUGIN
TillKit
CVE-2026-91078
Risk Score
Threat Entry
Updated 2026-10-06
Alttext Ai - Security Vulnerability (CVE-2026-91108)
The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.10.41. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the post_content of any post or page on the site — including content they do not own — with LLM-generated text influenced by attacker-controlled keywords, enabling black-hat SEO…
PLUGIN
Alttext Ai
CVE-2026-91108
Risk Score
Threat Entry
Updated 2026-10-06
Usc E Shop - Security Vulnerability (CVE-2026-87091)
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The IPN endpoint accepts the 'rel' and 'option' parameters with no authentication, nonce validation, or signature verification, meaning any unauthenticated attacker can directly submit malicious payloads that are stored and later rendered in the…
PLUGIN
Usc E Shop
CVE-2026-87091
Risk Score
Threat Entry
Updated 2026-10-06
Kubio AI Page Builder - Security Vulnerability (CVE-2026-88782)
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an administrator previewing the unpublished submission.
PLUGIN
Kubio AI Page Builder
CVE-2026-88782
Risk Score
Threat Entry
Updated 2026-10-06
MetForm - Security Vulnerability (CVE-2026-86834)
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.
PLUGIN
MetForm
CVE-2026-86834
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-85568)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated users to perform SQL injection attacks and to retrieve non-public content, when a related widget option is set away from its default.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-85568
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-85015)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access to its asset-management feature (Administrators by default, or Editors when a non-default Unlimited Elements for Elementor WordPress plugin before 2.0.21 setting is enabled) to write arbitrary files, including executable PHP, outside the intended upload directory on servers where the PHP zip extension is unavailable, leading to Remote Code Execution.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-85015
Risk Score