Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-25
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more - Security Vulnerability (CVE-2026-89426)
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the…
PLUGIN
Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more
CVE-2026-89426
Risk Score
Threat Entry
Updated 2026-09-25
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions - Security Vulnerability (CVE-2026-19804)
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for…
PLUGIN
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
CVE-2026-19804
Risk Score
Threat Entry
Updated 2026-09-25
Modula Best Grid Gallery - Security Vulnerability (CVE-2026-89406)
The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized disclosure of private gallery contents in versions up to, and including, 3.0.1. This is due to the Modula_Meta::add_metas() function being hooked to wp_head on every frontend request and looking up any post via get_post( $_GET['modula_gallery_id'] ) without verifying the gallery's post_status or the requester's capability to read it — the gallery-side input guard is bugged (empty('modula_gallery_id') tests a nonempty string literal instead of the GET parameter, so it is always false), the only…
PLUGIN
Modula Best Grid Gallery
CVE-2026-89406
Risk Score
Threat Entry
Updated 2026-09-25
Fancy Product Designer - Security Vulnerability (CVE-2026-84280)
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is written to the DOM via innerHTML within the beforeElementAdd JavaScript event handler when processing the elements[].title field from the stored order JSON, meaning execution occurs specifically when an…
PLUGIN
Fancy Product Designer
CVE-2026-84280
Risk Score
Threat Entry
Updated 2026-09-25
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More - Security Vulnerability (CVE-2026-88996)
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms…
PLUGIN
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
CVE-2026-88996
Risk Score
Threat Entry
Updated 2026-09-25
SSL Zen — SSL Certificate Installer & HTTPS Redirects - Security Vulnerability (CVE-2026-17577)
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The ssl_zen_messages::getMessages() function builds the 'token_missmatch' message using base64_decode(sanitize_text_field($_REQUEST['uri'])) and (optionally) base64_decode(sanitize_text_field($_REQUEST['host'])). sanitize_text_field() cannot strip HTML/JavaScript that is hidden inside a base64-encoded blob, and the resulting decoded raw HTML is echoed unescaped by showMessage() . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking…
PLUGIN
SSL Zen — SSL Certificate Installer & HTTPS Redirects
CVE-2026-17577
Risk Score
Threat Entry
Updated 2026-09-25
SSL Zen — SSL Certificate Installer & HTTPS Redirects - Security Vulnerability (CVE-2026-17602)
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
SSL Zen — SSL Certificate Installer & HTTPS Redirects
CVE-2026-17602
Risk Score
Threat Entry
Updated 2026-09-25
Wp Google Map Plugin - Security Vulnerability (CVE-2026-13456)
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
PLUGIN
Wp Google Map Plugin
CVE-2026-13456
Risk Score
Threat Entry
Updated 2026-09-25
Wp Google Map Plugin - Security Vulnerability (CVE-2026-13179)
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapes_values Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fc-call-nonce nonce required by the endpoint is exposed to all frontend visitors who view a map page via window.wpgmp_local.nonce, enabling any authenticated subscriber…
PLUGIN
Wp Google Map Plugin
CVE-2026-13179
Risk Score
Threat Entry
Updated 2026-09-25
Asset CleanUp: Page Speed Booster - Security Vulnerability (CVE-2026-12037)
The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'page_url' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. This vulnerability is only reachable when the plugin's dom_get_type setting has been configured to 'wp_remote_post' by an administrator.
PLUGIN
Asset CleanUp: Page Speed Booster
CVE-2026-12037
Risk Score
Threat Entry
Updated 2026-09-25
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory - Security Vulnerability (CVE-2026-96766)
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business_hours' parameter in all versions up to, and including, 2.8.183 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the AJAX save handler validates only post authorship and a nonce with no additional capability check, allowing…
PLUGIN
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
CVE-2026-96766
Risk Score
Threat Entry
Updated 2026-09-26
Bookly Responsive Appointment Booking Tool - Security Vulnerability (CVE-2026-93399)
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order…
PLUGIN
Bookly Responsive Appointment Booking Tool
CVE-2026-93399
Risk Score
Threat Entry
Updated 2026-09-25
Ba Book Everything - Security Vulnerability (CVE-2026-96039)
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit…
PLUGIN
Ba Book Everything
CVE-2026-96039
Risk Score
Threat Entry
Updated 2026-09-25
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots - Security Vulnerability (CVE-2026-93899)
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the…
PLUGIN
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
CVE-2026-93899
Risk Score
Threat Entry
Updated 2026-09-25
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots - Security Vulnerability (CVE-2026-94376)
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via User Display Name in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users because WordPress core's sanitize_text_field() preserves HTML-entity-encoded payloads (e.g., an iframe srcdoc…
PLUGIN
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
CVE-2026-94376
Risk Score
Threat Entry
Updated 2026-09-25
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory - Security Vulnerability (CVE-2026-93897)
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone') in all versions up to, and including, 2.8.181 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload must be stored in a text-type custom field (such as a phone field) via the AJAX geodir_save_post…
PLUGIN
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
CVE-2026-93897
Risk Score
Threat Entry
Updated 2026-09-25
Customer Reviews for WooCommerce - Security Vulnerability (CVE-2026-89055)
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library — including administrator-owned product images, logos, and documents — by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId distributed to customers via…
PLUGIN
Customer Reviews for WooCommerce
CVE-2026-89055
Risk Score
Threat Entry
Updated 2026-09-25
HT Contact Form – Drag & Drop Form Builder for WordPress - Security Vulnerability (CVE-2026-93303)
The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume in all versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires tricking a user into clicking an attacker-supplied draft resume URL, which the attacker constructs using the draft_key and…
PLUGIN
HT Contact Form – Drag & Drop Form Builder for WordPress
CVE-2026-93303
Risk Score
Threat Entry
Updated 2026-09-25
Fancy Product Designer - Security Vulnerability (CVE-2026-84281)
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The fpd_save_order AJAX action is registered for unauthenticated users via wp_ajax_nopriv_fpd_save_order with no nonce or capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON…
PLUGIN
Fancy Product Designer
CVE-2026-84281
Risk Score
Threat Entry
Updated 2026-09-25
Gutenverse – WordPress Blocks, Page Builder & Site Editor - Security Vulnerability (CVE-2026-92746)
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core wp_kses_post sanitization does not mitigate this vulnerability because the payload is stored inside a Gutenberg block delimiter comment…
PLUGIN
Gutenverse – WordPress Blocks, Page Builder & Site Editor
CVE-2026-92746
Risk Score