Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-28
efore 8.0.5, FileOrganizer - Security Vulnerability (CVE-2026-85081)
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below…
PLUGIN
efore 8.0.5, FileOrganizer
CVE-2026-85081
Risk Score
Threat Entry
Updated 2026-09-28
Bluff Post - Security Vulnerability (CVE-2026-89237)
The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated attackers to append additional SQL and extract sensitive information from the database.
PLUGIN
Bluff Post
CVE-2026-89237
Risk Score
Threat Entry
Updated 2026-09-28
Wp Review Slider Pro - Security Vulnerability (CVE-2026-84097)
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
PLUGIN
Wp Review Slider Pro
CVE-2026-84097
Risk Score
Threat Entry
Updated 2026-09-28
File Manager - Security Vulnerability (CVE-2026-19708)
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.
PLUGIN
File Manager
CVE-2026-19708
Risk Score
Threat Entry
Updated 2026-09-26
WP Directory Kit - Security Vulnerability (CVE-2026-16591)
The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting them in page attributes, allowing users with a WP Directory Kit WordPress plugin before 1.5.8-specific listing-management role (and without the unfiltered_html capability) to perform Stored Cross-Site Scripting attacks that execute for any visitor of the affected page.
PLUGIN
WP Directory Kit
CVE-2026-16591
Risk Score
Threat Entry
Updated 2026-09-29
Team Members - Security Vulnerability (CVE-2026-11871)
The Team Members WordPress plugin through 9.2 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
PLUGIN
Team Members
CVE-2026-11871
Risk Score
Threat Entry
Updated 2026-09-28
Automatic.css - Security Vulnerability (CVE-2026-15273)
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the Activity Log settings page.
PLUGIN
Automatic.css
CVE-2026-15273
Risk Score
Threat Entry
Updated 2026-09-25
Bookly - Security Vulnerability (CVE-2026-86837)
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.
PLUGIN
Bookly
CVE-2026-86837
Risk Score
Threat Entry
Updated 2026-09-25
wpForo Forum - Security Vulnerability (CVE-2026-80514)
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.
PLUGIN
wpForo Forum
CVE-2026-80514
Risk Score
Threat Entry
Updated 2026-09-25
MasterStudy LMS - Security Vulnerability (CVE-2026-88848)
The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.
PLUGIN
MasterStudy LMS
CVE-2026-88848
Risk Score
Threat Entry
Updated 2026-09-25
Zero Spam for WordPress - Security Vulnerability (CVE-2026-96752)
The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is delivered by submitting a Contact Form 7 request with a nested POST array key containing arbitrary HTML or JavaScript — PHP parses the…
PLUGIN
Zero Spam for WordPress
CVE-2026-96752
Risk Score
Threat Entry
Updated 2026-09-25
Mp Restaurant Menu - Security Vulnerability (CVE-2026-96568)
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Mp Restaurant Menu
CVE-2026-96568
Risk Score
Threat Entry
Updated 2026-09-25
Profile Builder - Security Vulnerability (CVE-2026-95866)
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored…
PLUGIN
Profile Builder
CVE-2026-95866
Risk Score
Threat Entry
Updated 2026-09-25
Themify Builder - Security Vulnerability (CVE-2026-95864)
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'css[fonts]' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required to reach the vulnerable endpoint is embedded in plain sight within the front-end page markup for all visitors, reducing the access control to a CSRF token rather than an authentication barrier and…
PLUGIN
Themify Builder
CVE-2026-95864
Risk Score
Threat Entry
Updated 2026-09-25
Repeater Fields for Elementor Forms - Security Vulnerability (CVE-2026-94573)
The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Repeater Fields for Elementor Forms
CVE-2026-94573
Risk Score
Threat Entry
Updated 2026-09-25
Modula Best Grid Gallery - Security Vulnerability (CVE-2026-92713)
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_image function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server. The path restriction to wp-content/uploads is not an effective ownership boundary, as all user attachment files reside within that tree, and Authors trivially satisfy the edit_post check on their own galleries.
PLUGIN
Modula Best Grid Gallery
CVE-2026-92713
Risk Score
Threat Entry
Updated 2026-09-25
Optima Express - Security Vulnerability (CVE-2026-93901)
The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the `provisionBlogCredentials()` function in `iHomefinderAdmin.php` being reachable via the `wp_ajax_nopriv_ihf_clear_cache` AJAX action — through the call chain `iHomefinderAjaxHandler::clearCache()` → `activateAuthenticationToken()` → `getAuthenticationInfo()` → `provisionBlogCredentials()` — with no capability check, nonce verification, or ownership validation, and the function unconditionally calling `$user->set_role('author')` on whichever WordPress account matches the hard-coded login `optima-express` via `get_user_by('login', 'optima-express')`. This makes it possible for unauthenticated attackers to escalate a pre-registered `optima-express` account to…
PLUGIN
Optima Express
CVE-2026-93901
Risk Score
Threat Entry
Updated 2026-09-25
Premium Packages – Sell Digital Products Securely - Security Vulnerability (CVE-2026-93654)
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The checkout REST route uses permission_callback set to __return_true and the invoice loader performs no order ownership check, meaning an unauthenticated attacker can both persist the payload and ensure it…
PLUGIN
Premium Packages – Sell Digital Products Securely
CVE-2026-93654
Risk Score
Threat Entry
Updated 2026-09-25
wpForo Forum - Security Vulnerability (CVE-2026-93747)
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profile_update action — the raw $_POST['data'] array is copied into a $custom_fields variable before validate() and sanitize() run, both of which operate only on a parallel $user reference, leaving $custom_fields unsanitized when it is persisted via update_custom_fields(); on render, wpforo_decode() reverses the entity encoding and the value is echoed without escaping in field_wrap_profile(). This…
PLUGIN
wpForo Forum
CVE-2026-93747
Risk Score
Threat Entry
Updated 2026-09-25
Profile Builder - Security Vulnerability (CVE-2026-93656)
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission; a Subscriber can plant…
PLUGIN
Profile Builder
CVE-2026-93656
Risk Score