Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-30
Image Optimizer - Security Vulnerability (CVE-2026-90953)
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
PLUGIN
Image Optimizer
CVE-2026-90953
Risk Score
Threat Entry
Updated 2026-09-30
Robin Image Optimizer - Security Vulnerability (CVE-2026-89190)
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.
PLUGIN
Robin Image Optimizer
CVE-2026-89190
Risk Score
Threat Entry
Updated 2026-09-30
Vayu X - Security Vulnerability (CVE-2026-88797)
The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository.
THEME
Vayu X
CVE-2026-88797
Risk Score
Threat Entry
Updated 2026-09-30
Hostinger Reach - Security Vulnerability (CVE-2026-87777)
The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor.
PLUGIN
Hostinger Reach
CVE-2026-87777
Risk Score
Threat Entry
Updated 2026-09-30
Connections Business Directory - Security Vulnerability (CVE-2026-86789)
The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses. The Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes.
PLUGIN
Connections Business Directory
CVE-2026-86789
Risk Score
Threat Entry
Updated 2026-09-30
Safe Redirect Manager - Security Vulnerability (CVE-2026-88791)
The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.
PLUGIN
Safe Redirect Manager
CVE-2026-88791
Risk Score
Threat Entry
Updated 2026-09-30
One Files Upload WordPress - Security Vulnerability (CVE-2026-85573)
The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens them.
PLUGIN
One Files Upload WordPress
CVE-2026-85573
Risk Score
Threat Entry
Updated 2026-09-30
Audio Player Block - Security Vulnerability (CVE-2026-85415)
The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link (such as an administrator or editor reviewing the post).
PLUGIN
Audio Player Block
CVE-2026-85415
Risk Score
Threat Entry
Updated 2026-09-30
One Files Upload WordPress - Security Vulnerability (CVE-2026-85576)
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
PLUGIN
One Files Upload WordPress
CVE-2026-85576
Risk Score
Threat Entry
Updated 2026-09-30
EmbedPress - Security Vulnerability (CVE-2026-85001)
The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.
PLUGIN
EmbedPress
CVE-2026-85001
Risk Score
Threat Entry
Updated 2026-09-30
New User Approve - Security Vulnerability (CVE-2026-83560)
The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.
PLUGIN
New User Approve
CVE-2026-83560
Risk Score
Threat Entry
Updated 2026-09-30
Solace Extra - Security Vulnerability (CVE-2026-80333)
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.
PLUGIN
Solace Extra
CVE-2026-80333
Risk Score
Threat Entry
Updated 2026-09-30
Schema & Structured Data for WP & AMP - Security Vulnerability (CVE-2026-82127)
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.
PLUGIN
Schema & Structured Data for WP & AMP
CVE-2026-82127
Risk Score
Threat Entry
Updated 2026-09-30
Zella Theme - Security Vulnerability (CVE-2026-75873)
The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.
THEME
Zella Theme
CVE-2026-75873
Risk Score
Threat Entry
Updated 2026-09-30
User Frontend - Security Vulnerability (CVE-2026-75824)
The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role.
PLUGIN
User Frontend
CVE-2026-75824
Risk Score
Threat Entry
Updated 2026-09-30
User Frontend - Security Vulnerability (CVE-2026-75823)
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained this way.
PLUGIN
User Frontend
CVE-2026-75823
Risk Score
Threat Entry
Updated 2026-09-30
FluentCart A New Era of eCommerce - Security Vulnerability (CVE-2026-100143)
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer's stored record.
PLUGIN
FluentCart A New Era of eCommerce
CVE-2026-100143
Risk Score
Threat Entry
Updated 2026-09-30
Frontend Post Submission Manager Lite - Security Vulnerability (CVE-2026-96649)
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site operator to have enabled guest post submission via the [fpsm] shortcode, which registers a publicly accessible AJAX handler gated…
PLUGIN
Frontend Post Submission Manager Lite
CVE-2026-96649
Risk Score
Threat Entry
Updated 2026-09-30
HT Contact Form – Drag & Drop Form Builder for WordPress - Security Vulnerability (CVE-2026-96326)
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
HT Contact Form – Drag & Drop Form Builder for WordPress
CVE-2026-96326
Risk Score
Threat Entry
Updated 2026-09-29
ConvertPlus - Security Vulnerability (CVE-2026-87741)
The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability exists because the action's nonce guard is gated behind an isset() check and fails open when the cp_admin_page_nonce parameter is omitted entirely, no capability check is performed on the callback, and sanitize_text_field() — applied to the $style value before it is concatenated directly into a shortcode string evaluated by do_shortcode() — does not strip shortcode delimiters, allowing an attacker…
PLUGIN
ConvertPlus
CVE-2026-87741
Risk Score