Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-23
CVE-2026-7613 - Cost Of Goods By Pixelyoursite Plugin
The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in versions up to, and including, 1.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Cost Of Goods By Pixelyoursite
CVE-2026-7613
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-45443 - Elementor Plugin
Missing Authorization vulnerability in ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Template Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through 5.5.1.
PLUGIN
Elementor
CVE-2026-45443
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-42383 - YITH WooCommerce Product Add-Ons Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0.
PLUGIN
YITH WooCommerce Product Add-Ons
CVE-2026-42383
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-27405 - WpBookingly Plugin
Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9.
PLUGIN
WpBookingly
CVE-2026-27405
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-24573 - Visualizer Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Visualizer allows Stored XSS. This issue affects Visualizer: from n/a before 4.0.0.
PLUGIN
Visualizer
CVE-2026-24573
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-27424 - Image Photo Gallery Final Tiles Grid Plugin
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.11.
PLUGIN
Image Photo Gallery Final Tiles Grid
CVE-2026-27424
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-6728 - Slider Revolution Plugin
The Slider Revolution plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.0.9 via the 'get_stream_data()' function. This makes it possible for unauthenticated attackers to extract sensitive data including published password-protected post, page, and product content.
PLUGIN
Slider Revolution
CVE-2026-6728
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-9065 - Surecart Plugin
SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'. The root cause is a flawed escaping bypass in the query builder ('wp-query-builder'). Values passed to the 'where()' method are only sanitized via '$wpdb->prepare()' when they do **not** contain a dot ('.') or the WordPress table prefix ('wp_'). By including a dot anywhere in the payload, an attacker completely bypasses the escaping logic and injects arbitrary SQL into the 'WHERE' clause, allowing full UNION-based extraction of…
PLUGIN
Surecart
CVE-2026-9065
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-6405 - Anomaly Detection And Alerting Plugin
The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in versions up to and including 0.3.6. This is due to missing nonce verification on the settings page handler and insufficient output escaping in the admin_options.php template. The settings form includes no wp_nonce_field() and the handler performs no check_admin_referer() check, meaning any cross-origin POST can modify plugin settings. The API key field is sanitized only with sanitize_text_field(), which strips HTML tags but does not encode double-quote…
PLUGIN
Anomaly Detection And Alerting
CVE-2026-6405
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-5200 - An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.
PLUGIN
An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress
CVE-2026-5200
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-7385 - Decent Comments Plugin
The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post author email addresses via its REST API endpoint, allowing unauthenticated attackers to enumerate registered user email addresses.
PLUGIN
Decent Comments
CVE-2026-7385
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-6566 - Nextgen Gallery Plugin
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0. This is due to insufficient object-level authorization in the image deletion REST flow where the permission callback for DELETE /imagely/v1/images/{id} only checks 'NextGEN Manage gallery' permissions and does not enforce gallery ownership or 'NextGEN Manage others gallery' permissions. This makes it possible for authenticated attackers, with Subscriber-level privileges and 'NextGEN Manage gallery' capability, to delete gallery images belonging to other users as well…
PLUGIN
Nextgen Gallery
CVE-2026-6566
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-5776 - Email Encoder Plugin
The Email Encoder WordPress plugin before 2.4.7 does not escape email addresses retrieved via user input, allowing unauthenticated attackers to perform Stored XSS attacks
PLUGIN
Email Encoder
CVE-2026-5776
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-2955 - Workflow Automation By Aiwu Plugin
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Practical exploitation is constrained due to a 20-character storage limit.
PLUGIN
Workflow Automation By Aiwu
CVE-2026-2955
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-7522 - Advanced Database Cleaner – Premium Plugin
The Advanced Database Cleaner – Premium plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.1.0 via the 'template' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
PLUGIN
Advanced Database Cleaner – Premium
CVE-2026-7522
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-5075 - All In One Seo Plugin
The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized script data in versions up to, and including, 4.9.7 due to sensitive internal option data being passed to wp_localize_script() in post editor contexts without effective masking for low-privilege users. This makes it possible for authenticated attackers, with contributor-level access and above, to view configured API/OAuth tokens and license-related values from page source.
PLUGIN
All In One Seo
CVE-2026-5075
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-9010 - Boost Plugin
The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Boost
CVE-2026-9010
Risk Score
Threat Entry
Updated 2026-07-24
CVE-2026-7637 - Boost Plugin
The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow…
PLUGIN
Boost
CVE-2026-7637
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-8685 - Infility Global Plugin
The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16. This is due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query within the show_control_data::post_list() function, which is registered as an admin menu page with only the 'read' capability. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive…
PLUGIN
Infility Global
CVE-2026-8685
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-8627 - Correct Prices Plugin
The Correct Prices plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $_SERVER['PHP_SELF'] variable in versions up to and including 1.0. This is due to the correct_prices_page() function echoing $_SERVER['PHP_SELF'] into a form's action attribute without any input sanitization or output escaping (such as esc_url() or esc_attr()). Because PHP_SELF reflects attacker-controlled path-info appended to the script URL, an attacker can break out of the attribute and inject arbitrary markup. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can…
PLUGIN
Correct Prices
CVE-2026-8627
Risk Score