Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-23
CVE-2026-9104 - Simple Draft List Plugin
The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The unescaped injection path is triggered specifically when the viewing user lacks edit capabilities, meaning payloads embedded in draft post titles via attribute-breakout techniques execute for unauthenticated users and…
PLUGIN
Simple Draft List
CVE-2026-9104
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-7509 - Kia Subtitle Plugin
The KIA Subtitle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `the-subtitle` shortcode `before` and `after` attributes in all versions up to, and including, 4.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Kia Subtitle
CVE-2026-7509
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-6864 - CBX 5 Star Rating & Review Plugin
The CBX 5 Star Rating & Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
PLUGIN
CBX 5 Star Rating & Review
CVE-2026-6864
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-7249 - Location Weather Plugin
The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the `splw_update_block_options()` and `lwp_clean_weather_transients()` functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to disable all weather blocks and purge all weather cache transients. The nonce required for these actions is exposed to all authenticated users via `wp_localize_script()` on the `init` hook.
PLUGIN
Location Weather
CVE-2026-7249
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-4070 - Alfie The Productfeedtool Wp Plugin
The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_manage() function which handles feed deletion via the 'delete' GET parameter. This makes it possible for unauthenticated attackers to delete arbitrary plugin feed data (from alfie_colindex, alfie_producten, alfie_reactions, and alfie_searchproduct tables) via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Alfie The Productfeedtool Wp
CVE-2026-4070
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-3481 - Wp Blockade Plugin
The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14. This is due to insufficient input sanitization and output escaping in the render_shortcode_preview() function. The function receives user input from $_GET['shortcode'], passes it through stripslashes() without any sanitization, and then outputs it directly via echo do_shortcode($shortcode) on line 393. When the input is not a valid WordPress shortcode (e.g., an HTML tag with JavaScript event handlers), do_shortcode() returns it unchanged, and it is reflected into the…
PLUGIN
Wp Blockade
CVE-2026-3481
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-2518 - Fastx Theme
The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback' and 'ultp_activate_callback' functions in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the PostX plugin.
THEME
Fastx
CVE-2026-2518
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-4834 - Wp Erp Pro Plugin
The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wp Erp Pro
CVE-2026-4834
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-6960 - BookingPress Appointment Booking Pro Plugin
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.
PLUGIN
BookingPress Appointment Booking Pro
CVE-2026-6960
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-4843 - Gsheet For Woo Importer Plugin
The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's Google Sheets API token and configuration options.
PLUGIN
Gsheet For Woo Importer
CVE-2026-4843
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-39593 - HAPPY Plugin
Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HAPPY: from n/a through 1.0.10.
PLUGIN
HAPPY
CVE-2026-39593
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-39531 - WP Directory Kit Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0.
PLUGIN
WP Directory Kit
CVE-2026-39531
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-5118 - Divi Form Builder Plugin
The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without validating it against the form's configured default_user_role setting. This makes it possible for unauthenticated attackers to create administrator accounts by tampering with the role parameter during registration.
PLUGIN
Divi Form Builder
CVE-2026-5118
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-27393 - CF7 WOW Styler Plugin
Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 WOW Styler: from n/a through 1.7.6.
PLUGIN
CF7 WOW Styler
CVE-2026-27393
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-27349 - Mail Mint Plugin
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data. This issue affects Mail Mint: from n/a through 1.19.5.
PLUGIN
Mail Mint
CVE-2026-27349
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-6279 - Fusion Builder Plugin
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowlist validation. This is exploitable by unauthenticated attackers through the `fusion_get_widget_markup` AJAX endpoint, which is registered for non-privileged (unauthenticated) users via `wp_ajax_nopriv_fusion_get_widget_markup`. The endpoint is protected only by a nonce (`fusion_load_nonce`), but this nonce is generated for user ID 0 and is deterministically…
PLUGIN
Fusion Builder
CVE-2026-6279
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-1543 - Avada (Fusion) Builder Theme
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an administrator) accesses a page displaying dynamic user data (such as via the Dynamic Data feature pulling user biographical information).
THEME
Avada (Fusion) Builder
CVE-2026-1543
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-4811 - Wpb Floating Menu Or Categories Plugin
The WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon CSS Class' category field in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wpb Floating Menu Or Categories
CVE-2026-4811
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-1881 - Broadstreet Plugin
The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disclose any private post metadata.
PLUGIN
Broadstreet
CVE-2026-1881
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-45444 - Gift Cards For WooCommerce Pro Plugin
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6.
PLUGIN
Gift Cards For WooCommerce Pro
CVE-2026-45444
Risk Score