Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-03
Mang Board - Security Vulnerability (CVE-2026-96871)
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable on any board configured with the default write_level=0 (guest posting) and editor_type=N settings, which are the out-of-the-box defaults for newly created boards.
PLUGIN
Mang Board
CVE-2026-96871
Risk Score
Threat Entry
Updated 2026-10-02
Gspeech - Security Vulnerability (CVE-2026-96578)
The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This mXSS-style transform bypasses WordPress comment kses sanitization because the payload is stored using only kses-allowed tags and attributes; the malicious event handlers and style fragments become active only…
PLUGIN
Gspeech
CVE-2026-96578
Risk Score
Threat Entry
Updated 2026-10-03
Mw Wp Form - Security Vulnerability (CVE-2026-96567)
The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The CSRF gate protecting form submission (MW_WP_Form_Csrf) is bypassable by any unauthenticated visitor who first loads the public form page to obtain a valid double-submit cookie, leaving no effective barrier to storing malicious…
PLUGIN
Mw Wp Form
CVE-2026-96567
Risk Score
Threat Entry
Updated 2026-10-03
Newsletter - Security Vulnerability (CVE-2026-96566)
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field Parameter in all versions up to, and including, 9.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The subscription endpoint (na=sa) requires no nonce, no capability check, and no CAPTCHA, and the payload can be smuggled past email-address validation by embedding the {profile_1} placeholder in…
PLUGIN
Newsletter
CVE-2026-96566
Risk Score
Threat Entry
Updated 2026-10-03
Listdom - Security Vulnerability (CVE-2026-96647)
The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[remark]' Parameter in all versions up to, and including, 6.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because the listing-creation branch of the AJAX handler omits a capability check, and the required nonce is publicly…
PLUGIN
Listdom
CVE-2026-96647
Risk Score
Threat Entry
Updated 2026-10-02
Dofollow Case By Case - Security Vulnerability (CVE-2026-95817)
The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.
PLUGIN
Dofollow Case By Case
CVE-2026-95817
Risk Score
Threat Entry
Updated 2026-10-03
Mihdan No External Links - Security Vulnerability (CVE-2026-95670)
The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has enabled the 'Link Encoding: Base64' option in the plugin settings.
PLUGIN
Mihdan No External Links
CVE-2026-95670
Risk Score
Threat Entry
Updated 2026-10-03
Custom Facebook Feed - Security Vulnerability (CVE-2026-93756)
The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook Comment Message via v-html in Admin Builder Preview in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the feed builder preview page. This attack requires only a Facebook account to post a comment on the connected Facebook Page, with no WordPress…
PLUGIN
Custom Facebook Feed
CVE-2026-93756
Risk Score
Threat Entry
Updated 2026-10-02
Greenshift Animation And Page Builder Blocks - Security Vulnerability (CVE-2026-93880)
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder in all versions up to, and including, 13.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires a site administrator to have configured an element block's Custom JS field to include a {{GET:...}} placeholder and…
PLUGIN
Greenshift Animation And Page Builder Blocks
CVE-2026-93880
Risk Score
Threat Entry
Updated 2026-10-03
Appointment Booking Plugin - Security Vulnerability (CVE-2026-94432)
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order_for_transaction() action registered as a public (unauthenticated) route through wp_ajax_nopriv_latepoint_route_call. The handler loads an OsInvoiceModel by a sequential integer 'invoice_id' with no access-key/UUID or ownership check (the sibling Stripe and Razorpay handlers require a 128-bit access-key UUID via OsInvoicesHelper::get_invoice_by_key), and then calls OsTransactionIntentHelper::create_or_update_transaction_intent() which persists a transaction intent tied to the target invoice's customer_id, order_id and charge_amount and regenerates…
PLUGIN
Appointment Booking Plugin
CVE-2026-94432
Risk Score
Threat Entry
Updated 2026-10-03
Dc Woocommerce Multi Vendor - Security Vulnerability (CVE-2026-12951)
The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query — the value is concatenated directly into an ORDER BY clause where esc_sql() (which only neutralizes characters needed to break out of quoted string literals) provides no protection. This makes it possible for authenticated attackers, with vendor-level access and above…
PLUGIN
Dc Woocommerce Multi Vendor
CVE-2026-12951
Risk Score
Threat Entry
Updated 2026-10-02
Relevanssi Premium - Security Vulnerability (CVE-2026-103426)
The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the click-tracking and logging feature to be activated in the plugin settings, and exploitation is trivially accessible to unauthenticated users because a valid _rt_nonce is publicly emitted on every search-results page.
PLUGIN
Relevanssi Premium
CVE-2026-103426
Risk Score
Threat Entry
Updated 2026-10-03
Cmb2 - Security Vulnerability (CVE-2026-102772)
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' (e.g. kl_code, kl_post_code)' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The front-end save path requires only a CMB2 box nonce, which is emitted to all visitors including unauthenticated guests via a simple GET request, making the attack trivially reachable without any credentials…
PLUGIN
Cmb2
CVE-2026-102772
Risk Score
Threat Entry
Updated 2026-10-02
Download Monitor - Security Vulnerability (CVE-2026-100182)
The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to trick an authenticated Administrator into visiting an attacker-controlled page that targets an open Download edit screen, after which the payload is persisted unfiltered via the Administrator's unfiltered_html…
PLUGIN
Download Monitor
CVE-2026-100182
Risk Score
Threat Entry
Updated 2026-10-03
Otter Blocks - Security Vulnerability (CVE-2026-102002)
The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.6 via the 'otter_form_widget_filter' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the email addresses of the five most recent form submitters, their submission dates, and the site's total form submission count. The widget is registered whenever the themeisle_blocks_form_emails option is non-empty — the normal state after any Form block has been saved —…
PLUGIN
Otter Blocks
CVE-2026-102002
Risk Score
Threat Entry
Updated 2026-10-03
Kubio AI Page Builder - Security Vulnerability (CVE-2026-100107)
The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Kubio AI Page Builder
CVE-2026-100107
Risk Score
Threat Entry
Updated 2026-10-02
MStore API - Security Vulnerability (CVE-2026-97219)
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying.
PLUGIN
MStore API
CVE-2026-97219
Risk Score
Threat Entry
Updated 2026-10-02
Events Calendar - Security Vulnerability (CVE-2026-84740)
The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it into its rendering context, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
PLUGIN
Events Calendar
CVE-2026-84740
Risk Score
Threat Entry
Updated 2026-10-02
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-92924)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed to make it, allowing users with a role as low as subscriber to have arbitrary WordPress shortcodes executed on the site. Version 2.0.18 removed the subscriber-level access, so from 2.0.18 onward the issue requires a Contributor role or above.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-92924
Risk Score
Threat Entry
Updated 2026-10-02
Popup Maker WP - Security Vulnerability (CVE-2026-85005)
The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store display-targeting values that are later invoked as zero-argument PHP callables on public page loads, leading to sensitive information disclosure and denial of service.
PLUGIN
Popup Maker WP
CVE-2026-85005
Risk Score