Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-01
Payments for Hubtel - Security Vulnerability (CVE-2026-96255)
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.
PLUGIN
Payments for Hubtel
CVE-2026-96255
Risk Score
Threat Entry
Updated 2026-10-01
Payments for Hubtel - Security Vulnerability (CVE-2026-96200)
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment.
PLUGIN
Payments for Hubtel
CVE-2026-96200
Risk Score
Threat Entry
Updated 2026-10-01
Five Star Restaurant Reviews - Security Vulnerability (CVE-2026-92412)
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
PLUGIN
Five Star Restaurant Reviews
CVE-2026-92412
Risk Score
Threat Entry
Updated 2026-10-01
WP Fusion Lite - Security Vulnerability (CVE-2026-90974)
The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.
PLUGIN
WP Fusion Lite
CVE-2026-90974
Risk Score
Threat Entry
Updated 2026-10-01
Payments for Hubtel - Security Vulnerability (CVE-2026-96173)
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.
PLUGIN
Payments for Hubtel
CVE-2026-96173
Risk Score
Threat Entry
Updated 2026-10-01
Pro Like Button - Security Vulnerability (CVE-2026-89296)
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
PLUGIN
Pro Like Button
CVE-2026-89296
Risk Score
Threat Entry
Updated 2026-10-01
WP Fusion Lite - Security Vulnerability (CVE-2026-90972)
The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.
PLUGIN
WP Fusion Lite
CVE-2026-90972
Risk Score
Threat Entry
Updated 2026-10-03
Redux Framework - Security Vulnerability (CVE-2026-88999)
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary media library attachments, including administrator-owned files, from the affected site. This is exploitable by Subscribers when a Custom Fonts field is registered on the user profile page via Redux_Users::set_profile(), as doing so causes the required redux_custom_fonts nonce to…
PLUGIN
Redux Framework
CVE-2026-88999
Risk Score
Threat Entry
Updated 2026-10-01
If-So Dynamic Content - Security Vulnerability (CVE-2026-87973)
The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the analytics page, allowing users with editor-level access to store JavaScript that executes in the session of a higher-privileged user who views that page.
PLUGIN
If-So Dynamic Content
CVE-2026-87973
Risk Score
Threat Entry
Updated 2026-10-01
Download Manager - Security Vulnerability (CVE-2026-86610)
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected, as the sanitisation applied when the setting is saved does not neutralise single quotes there.
PLUGIN
Download Manager
CVE-2026-86610
Risk Score
Threat Entry
Updated 2026-10-01
If-So Dynamic Content - Security Vulnerability (CVE-2026-87970)
The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.
PLUGIN
If-So Dynamic Content
CVE-2026-87970
Risk Score
Threat Entry
Updated 2026-10-01
Paytm Payment Gateway - Security Vulnerability (CVE-2026-81809)
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.
PLUGIN
Paytm Payment Gateway
CVE-2026-81809
Risk Score
Threat Entry
Updated 2026-10-03
Extendify - Security Vulnerability (CVE-2026-85679)
The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because registerIncoming() is hooked on rest_request_before_callbacks and runs before WordPress evaluates the route's permission_callback, meaning any unauthenticated POST, PUT, or PATCH request to a /wp/v2/global-styles route can trigger the vulnerable code…
PLUGIN
Extendify
CVE-2026-85679
Risk Score
Threat Entry
Updated 2026-10-01
Paytm Payment Gateway - Security Vulnerability (CVE-2026-81739)
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to store scripts that will run in the session of a store administrator.
PLUGIN
Paytm Payment Gateway
CVE-2026-81739
Risk Score
Threat Entry
Updated 2026-10-01
Cache Enabler - Security Vulnerability (CVE-2026-19253)
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete arbitrary files and directories on sites where another installed Cache Enabler WordPress plugin before 1.8.17 or passes a request-derived URL to its public cache-clearing hook.
PLUGIN
Cache Enabler
CVE-2026-19253
Risk Score
Threat Entry
Updated 2026-10-01
BackupSheep WordPress Backup Plugin - Security Vulnerability (CVE-2026-101148)
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover. The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.
PLUGIN
BackupSheep WordPress Backup Plugin
CVE-2026-101148
Risk Score
Threat Entry
Updated 2026-10-01
Featured Image from URL - Security Vulnerability (CVE-2026-101147)
The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF attack.
PLUGIN
Featured Image from URL
CVE-2026-101147
Risk Score
Threat Entry
Updated 2026-10-01
The Appointment Booking Plugin - Security Vulnerability (CVE-2026-92966)
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The payload is planted during the unauthenticated booking flow and triggered when the Customer Cabinet block rendered by render_customer_dashboard() outputs the stored name into the content stream,…
PLUGIN
The Appointment Booking Plugin
CVE-2026-92966
Risk Score
Threat Entry
Updated 2026-10-03
Wordpress Popular Posts - Security Vulnerability (CVE-2026-92548)
The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' parameter. This makes it possible for unauthenticated attackers to extract sensitive edit-context fields — including raw title, raw content body, password, meta, status, and guid — from non-public post objects such as wp_block synced patterns that WordPress core itself refuses to expose to unauthenticated callers. This is possible because the plugin's REST route is registered with a permission_callback of __return_true and passes the caller-supplied context parameter…
PLUGIN
Wordpress Popular Posts
CVE-2026-92548
Risk Score
Threat Entry
Updated 2026-10-03
Advanced Woo Labels - Security Vulnerability (CVE-2026-12241)
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to, and including, 2.51. This makes it possible for authenticated attackers, with Contributor-level access and above, to create AWS labels that are rendered without proper escaping. The vulnerability was partially patched in version 2.46.
PLUGIN
Advanced Woo Labels
CVE-2026-12241
Risk Score