Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-02
WebToffee Gift Cards for WooCommerce - Security Vulnerability (CVE-2026-91020)
The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it as the cart-item price and store-credit coupon value, allowing unauthenticated users to submit an arbitrary or negative amount, bypassing the configured denominations and manipulating the order total to obtain products without paying.
PLUGIN
WebToffee Gift Cards for WooCommerce
CVE-2026-91020
Risk Score
Threat Entry
Updated 2026-10-02
Easy PayPal & Stripe Buy Now Button - Security Vulnerability (CVE-2026-90987)
The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase.
PLUGIN
Easy PayPal & Stripe Buy Now Button
CVE-2026-90987
Risk Score
Threat Entry
Updated 2026-10-02
WP Edit Password Protected - Security Vulnerability (CVE-2026-90952)
The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide.
PLUGIN
WP Edit Password Protected
CVE-2026-90952
Risk Score
Threat Entry
Updated 2026-10-02
WP User Frontend - Security Vulnerability (CVE-2026-79618)
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts through forms restricted to paying subscribers.
PLUGIN
WP User Frontend
CVE-2026-79618
Risk Score
Threat Entry
Updated 2026-10-02
CMP - Coming Soon & Maintenance - Security Vulnerability (CVE-2026-13413)
The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, by shaping the request so it is mistaken for a login request.
PLUGIN
CMP - Coming Soon & Maintenance
CVE-2026-13413
Risk Score
Threat Entry
Updated 2026-10-02
WP Mail Logging - Security Vulnerability (CVE-2026-1661)
The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of logged emails before rendering them in its admin log screens, allowing unauthenticated users to inject styled content and links, for example through a public contact form, that can deceive an administrator viewing the log and send their browser to an attacker-controlled page.
PLUGIN
WP Mail Logging
CVE-2026-1661
Risk Score
Threat Entry
Updated 2026-10-03
Ba Book Everything - Security Vulnerability (CVE-2026-102565)
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_service_qty' parameter in all versions up to, and including, 1.8.28 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that an administrator or other privileged user opens the injected order record in the plugin's wp-admin order management area, which is the plugin's ordinary order-review workflow.
PLUGIN
Ba Book Everything
CVE-2026-102565
Risk Score
Threat Entry
Updated 2026-10-02
Ninja Forms - File Uploads - Security Vulnerability (CVE-2026-92820)
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file_path, which is then used without validation to attach a file to the form's notification email (arbitrary file read), to write fetched content (arbitrary file write, leading to remote code execution when the external store is configured), and in a scheduled deletion (arbitrary…
PLUGIN
Ninja Forms - File Uploads
CVE-2026-92820
Risk Score
Threat Entry
Updated 2026-10-03
SiteOrigin Widgets Bundle - Security Vulnerability (CVE-2026-92174)
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Exploitation requires sending a malicious widgetData…
PLUGIN
SiteOrigin Widgets Bundle
CVE-2026-92174
Risk Score
Threat Entry
Updated 2026-10-02
BuildKit - Security Vulnerability (CVE-2026-94298)
The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.
PLUGIN
BuildKit
CVE-2026-94298
Risk Score
Threat Entry
Updated 2026-10-02
Giveaways and Contests by RafflePress - Security Vulnerability (CVE-2026-97318)
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.
PLUGIN
Giveaways and Contests by RafflePress
CVE-2026-97318
Risk Score
Threat Entry
Updated 2026-10-02
Giveaways and Contests by RafflePress - Security Vulnerability (CVE-2026-97317)
The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.
PLUGIN
Giveaways and Contests by RafflePress
CVE-2026-97317
Risk Score
Threat Entry
Updated 2026-10-02
OMGF - Security Vulnerability (CVE-2026-91828)
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.
PLUGIN
OMGF
CVE-2026-91828
Risk Score
Threat Entry
Updated 2026-10-03
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder - Security Vulnerability (CVE-2026-90438)
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.
PLUGIN
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
CVE-2026-90438
Risk Score
Threat Entry
Updated 2026-10-02
Motors - Security Vulnerability (CVE-2026-91022)
The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.
PLUGIN
Motors
CVE-2026-91022
Risk Score
Threat Entry
Updated 2026-10-02
Request a Quote - Security Vulnerability (CVE-2026-90988)
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
PLUGIN
Request a Quote
CVE-2026-90988
Risk Score
Threat Entry
Updated 2026-10-02
do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors - Security Vulnerability (CVE-2026-91023)
The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.
PLUGIN
do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors
CVE-2026-91023
Risk Score
Threat Entry
Updated 2026-10-03
Super Forms – Drag & Drop Form Builder - Security Vulnerability (CVE-2026-15897)
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Because the super_save_form AJAX action also enforces no capability check, any authenticated user with Subscriber-level access and above can create the required malicious form (register_login_action='update' with register_login_user_id_update='true') and then submit it with user_id set…
PLUGIN
Super Forms – Drag & Drop Form Builder
CVE-2026-15897
Risk Score
Threat Entry
Updated 2026-10-02
Unlimited Elements for Elementor - Security Vulnerability (CVE-2026-85016)
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.
PLUGIN
Unlimited Elements for Elementor
CVE-2026-85016
Risk Score
Threat Entry
Updated 2026-10-02
Avada | Website Builder For WordPress & WooCommerce - Security Vulnerability (CVE-2026-84925)
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' parameter in all versions up to, and including, 7.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The injected value is propagated through Fusion_Multilingual::set_active_language() and concatenated into a URL by Fusion_Settings::get_setting_link() without applying urlencode(), esc_url(), or…
THEME
Avada | Website Builder For WordPress & WooCommerce
CVE-2026-84925
Risk Score