Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-40744 - Beaver Builder Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue affects Beaver Builder: from n/a through
PLUGIN
Beaver Builder
CVE-2026-40744
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40764 - WPForms Plugin
Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through
PLUGIN
WPForms
CVE-2026-40764
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40745 - Elementor Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This issue affects Element Pack Elementor Addons: from n/a through
PLUGIN
Elementor
CVE-2026-40745
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40740 - Tutor LMS Plugin
Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through
PLUGIN
Tutor LMS
CVE-2026-40740
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40778 - Majestic Support Plugin
Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through
PLUGIN
Majestic Support
CVE-2026-40778
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40763 - Elementor Plugin
Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through
PLUGIN
Elementor
CVE-2026-40763
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40742 - Nelio AB Testing Plugin
Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio AB Testing: from n/a through
PLUGIN
Nelio AB Testing
CVE-2026-40742
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40737 - COMPE Plugin
Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects COMPE: from n/a through
PLUGIN
COMPE
CVE-2026-40737
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40734 - Categories Images Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zahlan Categories Images categories-images allows DOM-Based XSS.This issue affects Categories Images: from n/a through
PLUGIN
Categories Images
CVE-2026-40734
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40730 - ThemeGrill Demo Importer
Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through
THEME
ThemeGrill Demo Importer
CVE-2026-40730
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40729 - 3D viewer – Embed 3D Models Plugin
Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through
PLUGIN
3D viewer – Embed 3D Models
CVE-2026-40729
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-40728 - Magazine Blocks Plugin
Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Blocks: from n/a through
PLUGIN
Magazine Blocks
CVE-2026-40728
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-5617 - One Click Login As User Plugin
The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the handle_return_to_admin() function trusting a client-controlled cookie (oclaup_original_admin) to determine which user to authenticate as, without any server-side verification that the cookie value was legitimately set during an admin-initiated user switch. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to administrator by setting the oclaup_original_admin cookie to an administrator's user ID and triggering the "Return to Admin" functionality.
PLUGIN
One Click Login As User
CVE-2026-5617
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-5694 - Quick Interest Slider Plugin
The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'loan-period' parameters in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Quick Interest Slider
CVE-2026-5694
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-5717 - Vi Include Post By Plugin
The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_container' attribute of the 'include-post-by-cat' shortcode in all versions up to, and including, 0.4.200706 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Vi Include Post By
CVE-2026-5717
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-4091 - Open Brain Plugin
The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0. This is due to missing nonce verification on the settings form in the func_page_main() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Open Brain
CVE-2026-4091
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-4011 - Wpgo Power Charts Lite Plugin
The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [pc] shortcode in all versions up to, and including, 0.1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute. Specifically, in the pc_shortcode() function, the 'id' attribute is extracted from user-supplied shortcode attributes and directly concatenated into an HTML div element's class attribute without any escaping or sanitization at line 62. The resulting HTML is then passed through html_entity_decode() before being returned, further undermining any…
PLUGIN
Wpgo Power Charts Lite
CVE-2026-4011
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-4005 - Coachific Shortcode Plugin
The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() on the 'userhash' parameter, which strips HTML tags but does not escape characters significant in a JavaScript string context (such as double quotes, semicolons, and parentheses). The sanitized value is then directly interpolated into a JavaScript string within a tag on line 29 without any JavaScript-specific escaping (e.g., wp_json_encode() or esc_js()).…
PLUGIN
Coachific Shortcode
CVE-2026-4005
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-3998 - Wm Jqmath Plugin
The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of the [jqmath] shortcode in all versions up to and including 1.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The generate_jqMathFormula() function directly concatenates the 'style' attribute value into an HTML style attribute without applying esc_attr() or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses…
PLUGIN
Wm Jqmath
CVE-2026-3998
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-3659 - Wp Circliful Plugin
The WP Circliful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [circliful] shortcode and via multiple shortcode attributes of the [circliful_direct] shortcode in all versions up to and including 1.2. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, in the circliful_shortcode() function, the 'id' attribute value is concatenated directly into an HTML id attribute (line 285) without any escaping, allowing an attacker to break out of the double-quoted attribute and inject arbitrary HTML event handlers.…
PLUGIN
Wp Circliful
CVE-2026-3659
Risk Score