Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-06
MetForm - Security Vulnerability (CVE-2026-86832)
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.
PLUGIN
MetForm
CVE-2026-86832
Risk Score
Threat Entry
Updated 2026-10-06
WP Ultimate CSV Importer - Security Vulnerability (CVE-2026-80518)
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads directory, nor does it block direct access to them, allowing unauthenticated attackers to retrieve the personal data of users imported from a CSV file.
PLUGIN
WP Ultimate CSV Importer
CVE-2026-80518
Risk Score
Threat Entry
Updated 2026-10-06
Helpdesk Support Ticket System for WooCommerce - Security Vulnerability (CVE-2026-11399)
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID to the deletion handler after obtaining the nonce from the admin footer.
PLUGIN
Helpdesk Support Ticket System for WooCommerce
CVE-2026-11399
Risk Score
Threat Entry
Updated 2026-10-06
WP Ultimate CSV Importer - Security Vulnerability (CVE-2026-80517)
The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content before storing them in a publicly served location, allowing high privilege users such as administrators to achieve Stored Cross-Site Scripting. On Multisite installations a site Administrator does not hold the unfiltered_html capability, so this lets them run scripts in the session of users who view the file, including Network Super Admins.
PLUGIN
WP Ultimate CSV Importer
CVE-2026-80517
Risk Score
Threat Entry
Updated 2026-10-06
Geodirectory - Security Vulnerability (CVE-2026-103913)
The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation on coordinate values when a listing is saved, combined with the direct string interpolation of those values into a distance sub-expression in geodir_gps_query_part() that is later executed by the public wp_ajax_nopriv_geodir_widget_listings handler when a caller supplies set_post= and sort_by=distance_asc. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append…
PLUGIN
Geodirectory
CVE-2026-103913
Risk Score
Threat Entry
Updated 2026-10-06
Calculated Fields Form - Security Vulnerability (CVE-2026-103909)
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary (whichever names the admin bound via url.)' parameter in all versions up to, and including, 5.5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the…
PLUGIN
Calculated Fields Form
CVE-2026-103909
Risk Score
Threat Entry
Updated 2026-10-06
Woo Smart Quick View - Security Vulnerability (CVE-2026-103888)
The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' parameter in all versions up to, and including, 4.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The WooCommerce "redirect to cart after add to cart" option must be enabled for the filter that reads the woosq-redirect parameter…
PLUGIN
Woo Smart Quick View
CVE-2026-103888
Risk Score
Threat Entry
Updated 2026-10-06
WP 2FA - Security Vulnerability (CVE-2026-103514)
The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on administrator accounts.
PLUGIN
WP 2FA
CVE-2026-103514
Risk Score
Threat Entry
Updated 2026-10-06
Magic Tooltips For Contact Form 7 - Security Vulnerability (CVE-2026-101928)
The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 1.0.34 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin's esc_html filter callback decodes HTML-entity-encoded payloads (e.g. those containing '<tip>') back into live HTML, meaning an entity-encoded script payload submitted as a comment author…
PLUGIN
Magic Tooltips For Contact Form 7
CVE-2026-101928
Risk Score
Threat Entry
Updated 2026-10-06
MPG - Security Vulnerability (CVE-2026-103293)
The MPG WordPress plugin before 4.2.3 does not validate that the dataset source supplied when importing a project is a remote URL before treating it as a local filesystem path and copying that file into a publicly accessible uploads folder. This makes it possible for users with the Editor role and above to read the contents of arbitrary files on the server, with the copied file then retrievable by unauthenticated visitors.
PLUGIN
MPG
CVE-2026-103293
Risk Score
Threat Entry
Updated 2026-10-06
Woo Photo Reviews - Security Vulnerability (CVE-2026-101923)
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter, combined with the delete_reviews_image() handler unconditionally calling wp_delete_post( $id, true ) on every stored ID when the review is deleted. This makes it possible for unauthenticated attackers to permanently delete arbitrary posts,…
PLUGIN
Woo Photo Reviews
CVE-2026-101923
Risk Score
Threat Entry
Updated 2026-10-06
Wp Seopress - Security Vulnerability (CVE-2026-101357)
The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'seopress_google_analytics_matomo_id' parameter in all versions up to, and including, 10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have delegated the Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings.
PLUGIN
Wp Seopress
CVE-2026-101357
Risk Score
Threat Entry
Updated 2026-10-06
WP Ultimate Review - Security Vulnerability (CVE-2026-101161)
The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of service when the WP Ultimate Review WordPress plugin before 2.4.4's review display settings have never been saved.
PLUGIN
WP Ultimate Review
CVE-2026-101161
Risk Score
Threat Entry
Updated 2026-10-06
WP Ultimate Review - Security Vulnerability (CVE-2026-101160)
The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed content fail with a fatal error for all visitors until the review is removed (a persistent denial of service), when user reviews are enabled.
PLUGIN
WP Ultimate Review
CVE-2026-101160
Risk Score
Threat Entry
Updated 2026-10-06
WP Ultimate Review - Security Vulnerability (CVE-2026-101159)
The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attacks against any user, including administrators, viewing a page displaying the review, when user reviews are enabled.
PLUGIN
WP Ultimate Review
CVE-2026-101159
Risk Score
Threat Entry
Updated 2026-10-06
WP Ultimate Review - Security Vulnerability (CVE-2026-101162)
The WP Ultimate Review WordPress plugin before 2.4.4 does not escape some of its review overview settings before outputting them in posts, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks, when author reviews are enabled.
PLUGIN
WP Ultimate Review
CVE-2026-101162
Risk Score
Threat Entry
Updated 2026-10-06
All In One Seo Pack - Security Vulnerability (CVE-2026-100152)
The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This requires the AIOSEO breadcrumb to be rendered on the search results page via the block, widget,…
PLUGIN
All In One Seo Pack
CVE-2026-100152
Risk Score
Threat Entry
Updated 2026-10-06
Social Icons Widget By Wpzoom - Security Vulnerability (CVE-2026-100149)
The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature (attacker-obtained via inline_js identify payload)' parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires…
PLUGIN
Social Icons Widget By Wpzoom
CVE-2026-100149
Risk Score
Threat Entry
Updated 2026-10-06
Widget Google Reviews - Security Vulnerability (CVE-2026-100148)
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reviews[].text' parameter in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered entirely through a Google review posted for the connected business and requires no WordPress account; the plugin's default daily cron auto-imports the…
PLUGIN
Widget Google Reviews
CVE-2026-100148
Risk Score
Threat Entry
Updated 2026-10-06
Groundhogg - Security Vulnerability (CVE-2026-97644)
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user…
PLUGIN
Groundhogg
CVE-2026-97644
Risk Score