Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-28
SPS-Suite - Security Vulnerability (CVE-2026-93000)
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.
PLUGIN
SPS-Suite
CVE-2026-93000
Risk Score
Threat Entry
Updated 2026-09-28
Post Voting System - Security Vulnerability (CVE-2026-89303)
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.
PLUGIN
Post Voting System
CVE-2026-89303
Risk Score
Threat Entry
Updated 2026-09-28
Blacklist Manager for WooCommerce - Security Vulnerability (CVE-2026-88828)
The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.
PLUGIN
Blacklist Manager for WooCommerce
CVE-2026-88828
Risk Score
Threat Entry
Updated 2026-09-28
from 4 - Security Vulnerability (CVE-2026-92996)
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark any order as paid.
PLUGIN
from 4
CVE-2026-92996
Risk Score
Threat Entry
Updated 2026-09-28
from 4 - Security Vulnerability (CVE-2026-89411)
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.
PLUGIN
from 4
CVE-2026-89411
Risk Score
Threat Entry
Updated 2026-09-28
WP Verify API - Security Vulnerability (CVE-2026-89300)
The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.
PLUGIN
WP Verify API
CVE-2026-89300
Risk Score
Threat Entry
Updated 2026-09-28
WPForms Lite - Security Vulnerability (CVE-2026-84744)
The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.
PLUGIN
WPForms Lite
CVE-2026-84744
Risk Score
Threat Entry
Updated 2026-09-28
Bookly - Security Vulnerability (CVE-2026-86838)
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
PLUGIN
Bookly
CVE-2026-86838
Risk Score
Threat Entry
Updated 2026-09-28
PowerPress Podcasting plugin by Blubrry - Security Vulnerability (CVE-2026-97319)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2026-97319
Risk Score
Threat Entry
Updated 2026-09-28
Optima Express IDX - Security Vulnerability (CVE-2026-96899)
The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.
PLUGIN
Optima Express IDX
CVE-2026-96899
Risk Score
Threat Entry
Updated 2026-09-28
te's configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster - Security Vulnerability (CVE-2026-97227)
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8's configuration.
PLUGIN
te's configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster
CVE-2026-97227
Risk Score
Threat Entry
Updated 2026-09-28
Malcure Malware Shield - Security Vulnerability (CVE-2026-96896)
The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.
PLUGIN
Malcure Malware Shield
CVE-2026-96896
Risk Score
Threat Entry
Updated 2026-09-28
WP YouTube Lyte - Security Vulnerability (CVE-2026-96895)
The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.
PLUGIN
WP YouTube Lyte
CVE-2026-96895
Risk Score
Threat Entry
Updated 2026-09-28
WPeMatico RSS Feed Fetcher - Security Vulnerability (CVE-2026-89006)
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
WPeMatico RSS Feed Fetcher
CVE-2026-89006
Risk Score
Threat Entry
Updated 2026-09-28
Optima Express IDX - Security Vulnerability (CVE-2026-96897)
The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.
PLUGIN
Optima Express IDX
CVE-2026-96897
Risk Score
Threat Entry
Updated 2026-09-28
Verge3D Publishing and E-Commerce - Security Vulnerability (CVE-2026-92995)
The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.
PLUGIN
Verge3D Publishing and E-Commerce
CVE-2026-92995
Risk Score
Threat Entry
Updated 2026-09-28
Mailchimp for WooCommerce - Security Vulnerability (CVE-2026-92436)
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address to confirm that the customer shops at the store and to read that customer's saved cart contents.
PLUGIN
Mailchimp for WooCommerce
CVE-2026-92436
Risk Score
Threat Entry
Updated 2026-09-28
WPeMatico RSS Feed Fetcher - Security Vulnerability (CVE-2026-89003)
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the responses back.
PLUGIN
WPeMatico RSS Feed Fetcher
CVE-2026-89003
Risk Score
Threat Entry
Updated 2026-09-28
WPeMatico RSS Feed Fetcher - Security Vulnerability (CVE-2026-89001)
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user, including an administrator, as the post author.
PLUGIN
WPeMatico RSS Feed Fetcher
CVE-2026-89001
Risk Score
Threat Entry
Updated 2026-09-28
WPeMatico RSS Feed Fetcher - Security Vulnerability (CVE-2026-89000)
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only resources and read the responses back.
PLUGIN
WPeMatico RSS Feed Fetcher
CVE-2026-89000
Risk Score