Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-28
Online Scheduling and Appointment Booking System - Security Vulnerability (CVE-2026-86841)
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.
PLUGIN
Online Scheduling and Appointment Booking System
CVE-2026-86841
Risk Score
Threat Entry
Updated 2026-09-28
Download Manager - Security Vulnerability (CVE-2026-86609)
The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin before 7.5.6 published under the same slug does not ship the affected feature.
PLUGIN
Download Manager
CVE-2026-86609
Risk Score
Threat Entry
Updated 2026-09-28
Online Scheduling and Appointment Booking System - Security Vulnerability (CVE-2026-86839)
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.
PLUGIN
Online Scheduling and Appointment Booking System
CVE-2026-86839
Risk Score
Threat Entry
Updated 2026-09-28
EmbedPress - Security Vulnerability (CVE-2026-85002)
The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post.
PLUGIN
EmbedPress
CVE-2026-85002
Risk Score
Threat Entry
Updated 2026-09-28
WebFacing™ - Security Vulnerability (CVE-2026-84069)
The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion.
PLUGIN
WebFacing™
CVE-2026-84069
Risk Score
Threat Entry
Updated 2026-09-28
efore 1.26.8, UpdraftPlus - Security Vulnerability (CVE-2026-82841)
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.
PLUGIN
efore 1.26.8, UpdraftPlus
CVE-2026-82841
Risk Score
Threat Entry
Updated 2026-09-28
Ad Inserter - Security Vulnerability (CVE-2026-81655)
The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.
PLUGIN
Ad Inserter
CVE-2026-81655
Risk Score
Threat Entry
Updated 2026-09-28
Ultimate Addons For Contact Form 7 - Security Vulnerability (CVE-2026-82901)
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_mail_components' function in all versions up to, and including, 3.5.50. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: This is only exploitable when the plugin's PDF Generator module is enabled, which is disabled by default.
PLUGIN
Ultimate Addons For Contact Form 7
CVE-2026-82901
Risk Score
Threat Entry
Updated 2026-09-28
miniOrange OTP Login, Verification and SMS Notifications - Security Vulnerability (CVE-2026-85984)
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log…
PLUGIN
miniOrange OTP Login, Verification and SMS Notifications
CVE-2026-85984
Risk Score
Threat Entry
Updated 2026-09-28
Groups – Memberships and Access Control - Security Vulnerability (CVE-2026-77203)
The Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0. This is due to the groups_join() function deriving group-join eligibility from the ambient post's author capabilities via the global $post->post_author rather than from the currently authenticated user's own capabilities, while simultaneously minting and returning a valid groups-join-data hash and WordPress nonce for the caller in the same response — eliminating all authorization barriers to self-enrollment. This makes it possible for authenticated attackers, with Subscriber-level access and above,…
PLUGIN
Groups – Memberships and Access Control
CVE-2026-77203
Risk Score
Threat Entry
Updated 2026-09-28
MCP Server for WordPress - Security Vulnerability (CVE-2026-96524)
The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.
PLUGIN
MCP Server for WordPress
CVE-2026-96524
Risk Score
Threat Entry
Updated 2026-09-28
Testimonials Widget - Security Vulnerability (CVE-2026-96532)
The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form, allowing unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.
PLUGIN
Testimonials Widget
CVE-2026-96532
Risk Score
Threat Entry
Updated 2026-09-28
Optimole - Security Vulnerability (CVE-2026-96531)
The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.
PLUGIN
Optimole
CVE-2026-96531
Risk Score
Threat Entry
Updated 2026-09-28
WP Delicious - Security Vulnerability (CVE-2026-92411)
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.
PLUGIN
WP Delicious
CVE-2026-92411
Risk Score
Threat Entry
Updated 2026-09-28
Testimonials Widget - Security Vulnerability (CVE-2026-96533)
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.
PLUGIN
Testimonials Widget
CVE-2026-96533
Risk Score
Threat Entry
Updated 2026-09-28
MCP Server for WordPress - Security Vulnerability (CVE-2026-96526)
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.
PLUGIN
MCP Server for WordPress
CVE-2026-96526
Risk Score
Threat Entry
Updated 2026-09-28
MCP Server for WordPress - Security Vulnerability (CVE-2026-96525)
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflows created by administrators.
PLUGIN
MCP Server for WordPress
CVE-2026-96525
Risk Score
Threat Entry
Updated 2026-09-28
Request a Quote for WooCommerce - Security Vulnerability (CVE-2026-18143)
The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.
PLUGIN
Request a Quote for WooCommerce
CVE-2026-18143
Risk Score
Threat Entry
Updated 2026-09-28
Wp Review Slider Pro - Security Vulnerability (CVE-2026-84096)
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.
PLUGIN
Wp Review Slider Pro
CVE-2026-84096
Risk Score
Threat Entry
Updated 2026-09-28
Wp Review Slider Pro - Security Vulnerability (CVE-2026-84095)
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.
PLUGIN
Wp Review Slider Pro
CVE-2026-84095
Risk Score