Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-42648 - Spectra Plugin
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through
PLUGIN
Spectra
CVE-2026-42648
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42646 - TaxoPress Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Burge TaxoPress simple-tags allows Blind SQL Injection.This issue affects TaxoPress: from n/a through
PLUGIN
TaxoPress
CVE-2026-42646
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42643 - Image Widget Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Image Widget image-widget allows Stored XSS.This issue affects Image Widget: from n/a through
PLUGIN
Image Widget
CVE-2026-42643
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42641 - Share This Image Plugin
Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows Server Side Request Forgery.This issue affects Share This Image: from n/a through
PLUGIN
Share This Image
CVE-2026-42641
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42644 - BetterDocs Plugin
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitive Data.This issue affects BetterDocs: from n/a through
PLUGIN
BetterDocs
CVE-2026-42644
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42642 - GiveWP Plugin
Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through
PLUGIN
GiveWP
CVE-2026-42642
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42645 - Barcode Scanner with Inventory & Order Manager Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Cross Site Request Forgery.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through
PLUGIN
Barcode Scanner with Inventory & Order Manager
CVE-2026-42645
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2902 - Wp Meteor Website Speed Optimization Addon Plugin
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frontend_rewrite' function's 'WPMETEOR[N]WPMETEOR' placeholder content in all versions up to, and including, 3.4.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Meteor Website Speed Optimization Addon
CVE-2026-2902
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-4019 - Ccpa Cookie Consent Plugin
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/{post_id}/{block_id} using __return_true as the permission_callback, allowing any unauthenticated user to access it. The cmplz_rest_consented_content() function retrieves a post by ID via get_post() and returns the consentedContent attribute of any complianz/consent-area block found in it, without checking if the post is published or if the user has permission to read it. This makes it possible for unauthenticated attackers…
PLUGIN
Ccpa Cookie Consent
CVE-2026-4019
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42412 - WP User Frontend Plugin
Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Frontend: from n/a through 4.3.1.
PLUGIN
WP User Frontend
CVE-2026-42412
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42377 - SureForms Pro Plugin
Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms Pro: from n/a through 2.8.0.
PLUGIN
SureForms Pro
CVE-2026-42377
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-4805 - Woostify Plugin
The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated directly into a jQuery HTML string without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Woostify
CVE-2026-4805
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-4911 - Booking Package Plugin
The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() function passing user-controlled $_POST['amount'] directly to the Stripe PaymentIntent API without validation, and the commitStripe() function ignoring the server-calculated amount when confirming the payment. While the server correctly calculates the booking cost via getAmount() based on services, guests, taxes, and coupons, this calculated amount is never validated against or used to update the PaymentIntent because the critical code in CreditCard.php that would include the calculated amount…
PLUGIN
Booking Package
CVE-2026-4911
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-5306 - Log Email Plugin
The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks when the email encoder setting is enabled
PLUGIN
Log Email
CVE-2026-5306
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-6809 - Social Post Embed Plugin
The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on the user-supplied URL. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Social Post Embed
CVE-2026-6809
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-6725 - Wpc Smart Messages Plugin
The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the `wpcsm_text_rotator` shortcode in all versions up to, and including, 4.2.8. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wpc Smart Messages
CVE-2026-6725
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-6551 - Timeline Blocks Plugin
The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' attribute of the timeline-blocks/tb-timeline-blocks block in all versions up to, and including, 1.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Timeline Blocks
CVE-2026-6551
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-6741 - Calendar Booking Plugin For Appointments And Events
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the connect-customer-to-wp-user ability, which only requires the customer__edit capability granted to the latepoint_agent role by default, without verifying whether the target WordPress user ID belongs to a privileged account. This makes it possible for authenticated attackers with the latepoint_agent role to link any LatePoint customer record to an administrator's WordPress account and…
PLUGIN
Calendar Booking Plugin For Appointments And Events
CVE-2026-6741
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42410 - Elementor Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows DOM-Based XSS.This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.
PLUGIN
Elementor
CVE-2026-42410
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22337 - Directorist Social Login Plugin
Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4.
PLUGIN
Directorist Social Login
CVE-2026-22337
Risk Score