Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-30
Bold Page Builder - Security Vulnerability (CVE-2026-6173)
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Bold Page Builder
CVE-2026-6173
Risk Score
Threat Entry
Updated 2026-09-30
Bold Page Builder - Security Vulnerability (CVE-2026-6172)
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Bold Page Builder
CVE-2026-6172
Risk Score
Threat Entry
Updated 2026-09-30
Bold Page Builder - Security Vulnerability (CVE-2026-6171)
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Bold Page Builder
CVE-2026-6171
Risk Score
Threat Entry
Updated 2026-09-30
Bold Page Builder - Security Vulnerability (CVE-2026-6170)
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Bold Page Builder
CVE-2026-6170
Risk Score
Threat Entry
Updated 2026-09-30
WP Directory Kit - Security Vulnerability (CVE-2026-16596)
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
WP Directory Kit
CVE-2026-16596
Risk Score
Threat Entry
Updated 2026-09-30
Smart Slider 3 - Security Vulnerability (CVE-2026-14876)
The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Smart Slider 3
CVE-2026-14876
Risk Score
Threat Entry
Updated 2026-09-30
HT Mega Addons for Elementor – Elementor Widgets & Template Builder - Security Vulnerability (CVE-2026-11895)
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'display_options' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
HT Mega Addons for Elementor – Elementor Widgets & Template Builder
CVE-2026-11895
Risk Score
Threat Entry
Updated 2026-09-30
Give - Security Vulnerability (CVE-2026-97196)
Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9.
PLUGIN
Give
CVE-2026-97196
Risk Score
Threat Entry
Updated 2026-09-30
Simply Schedule Appointments - Security Vulnerability (CVE-2026-89294)
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication…
PLUGIN
Simply Schedule Appointments
CVE-2026-89294
Risk Score
Threat Entry
Updated 2026-09-30
Broken Link Notifier - Security Vulnerability (CVE-2026-97316)
The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services.
PLUGIN
Broken Link Notifier
CVE-2026-97316
Risk Score
Threat Entry
Updated 2026-09-30
Course Booking System - Security Vulnerability (CVE-2026-96886)
The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.
PLUGIN
Course Booking System
CVE-2026-96886
Risk Score
Threat Entry
Updated 2026-09-30
YayReviews - Security Vulnerability (CVE-2026-94274)
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.
PLUGIN
YayReviews
CVE-2026-94274
Risk Score
Threat Entry
Updated 2026-09-30
InPost PL - Security Vulnerability (CVE-2026-93580)
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and prematurely mark the order completed.
PLUGIN
InPost PL
CVE-2026-93580
Risk Score
Threat Entry
Updated 2026-09-30
Media Library Organizer - Security Vulnerability (CVE-2026-94297)
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.
PLUGIN
Media Library Organizer
CVE-2026-94297
Risk Score
Threat Entry
Updated 2026-09-30
Verge3D Publishing and E-Commerce - Security Vulnerability (CVE-2026-92994)
The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the browser of any user who opens it.
PLUGIN
Verge3D Publishing and E-Commerce
CVE-2026-92994
Risk Score
Threat Entry
Updated 2026-09-30
WP Mobile Menu - Security Vulnerability (CVE-2026-91832)
The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visitor, resulting in Stored Cross-Site Scripting.
PLUGIN
WP Mobile Menu
CVE-2026-91832
Risk Score
Threat Entry
Updated 2026-09-30
Content Egg - Security Vulnerability (CVE-2026-92424)
The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary web scripts unfiltered under a privileged user's account, executing in the context of anyone who later views that content.
PLUGIN
Content Egg
CVE-2026-92424
Risk Score
Threat Entry
Updated 2026-09-30
EWWW Image Optimizer - Security Vulnerability (CVE-2026-91051)
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .
PLUGIN
EWWW Image Optimizer
CVE-2026-91051
Risk Score
Threat Entry
Updated 2026-09-30
EWWW Image Optimizer - Security Vulnerability (CVE-2026-91072)
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.
PLUGIN
EWWW Image Optimizer
CVE-2026-91072
Risk Score
Threat Entry
Updated 2026-09-30
Robin Image Optimizer - Security Vulnerability (CVE-2026-89193)
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
PLUGIN
Robin Image Optimizer
CVE-2026-89193
Risk Score