Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-25
JetFormBuilder — Dynamic Blocks Form Builder - Security Vulnerability (CVE-2026-92212)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable…
PLUGIN
JetFormBuilder — Dynamic Blocks Form Builder
CVE-2026-92212
Risk Score
Threat Entry
Updated 2026-09-25
Bookly Responsive Appointment Booking Tool - Security Vulnerability (CVE-2026-92799)
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the `postValidateCustomer()` function using a loose PHP inequality operator (`!=`) to compare the session-stored one-time verification code against the attacker-supplied `verification_code` parameter — a flaw that is further exposed by the booking AJAX controller registering all its methods as `wp_ajax_nopriv_` handlers and unconditionally overriding `csrfTokenValid()` to return true, leaving the endpoint both unauthenticated and CSRF-unprotected. This makes…
PLUGIN
Bookly Responsive Appointment Booking Tool
CVE-2026-92799
Risk Score
Threat Entry
Updated 2026-09-25
Blog2Social: Social Media Auto Post & Scheduler - Security Vulnerability (CVE-2026-92829)
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view, modify, or delete other users' Blog2Social records, including disclosing another user's network authentication IDs and scheduled post content, overwriting Open Graph and Twitter Card post metadata on posts they do not own, rebinding another…
PLUGIN
Blog2Social: Social Media Auto Post & Scheduler
CVE-2026-92829
Risk Score
Threat Entry
Updated 2026-09-25
Elementor - Security Vulnerability (CVE-2026-62062)
Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.
PLUGIN
Elementor
CVE-2026-62062
Risk Score
Threat Entry
Updated 2026-09-25
Fancy Product Designer - Security Vulnerability (CVE-2026-84279)
The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the Pro Export/Genius feature to be enabled on the site, as the vulnerable fpd_pr_export AJAX action is only registered when that feature is active.
PLUGIN
Fancy Product Designer
CVE-2026-84279
Risk Score
Threat Entry
Updated 2026-09-25
Accelerated Mobile Pages - Security Vulnerability (CVE-2026-83591)
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The crafted payload uses only WordPress-permitted comment tags and attributes (an anchor with href and title), and the AMP sanitizer pipeline omits javascript: protocol blocking, meaning neither…
PLUGIN
Accelerated Mobile Pages
CVE-2026-83591
Risk Score
Threat Entry
Updated 2026-09-25
Link Library - Security Vulnerability (CVE-2026-78393)
The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in administrators.
PLUGIN
Link Library
CVE-2026-78393
Risk Score
Threat Entry
Updated 2026-09-25
Link Library - Security Vulnerability (CVE-2026-78394)
The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including outside the site's document root. The written file name is always numeric with a fixed image extension, so executable code cannot be planted this way.
PLUGIN
Link Library
CVE-2026-78394
Risk Score
Threat Entry
Updated 2026-09-25
Link Library - Security Vulnerability (CVE-2026-78397)
The Link Library WordPress plugin before 7.9.6 does not validate the destination of a user-supplied URL before falling back to an unprotected fetch when its safe request is rejected, allowing unauthenticated visitors to make the site issue requests to hosts on its internal network and to learn from the response whether an internal service answered. Versions below 7.8.8 are covered by CVE-2025-68600; this entry covers 7.8.8 through 7.9.5, where that fix was incomplete. Exploitation requires the site owner to have published the Link Library WordPress plugin before 7.9.6's public link…
PLUGIN
Link Library
CVE-2026-78397
Risk Score
Threat Entry
Updated 2026-09-25
Automation Web Platform - Security Vulnerability (CVE-2026-14281)
The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/` and the absence of a key allowlist in the `finish_registration_logic` function, which copies the attacker-controlled `wawp_custom_fields` parameter directly into `update_user_meta()` — allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set by the caller. This makes it possible for unauthenticated attackers to register a…
PLUGIN
Automation Web Platform
CVE-2026-14281
Risk Score
Threat Entry
Updated 2026-09-25
Desktop Mode - Security Vulnerability (CVE-2026-19775)
The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to read the title, status, date, permalink, and a 300-character content excerpt of any private, draft, pending, or future post, as well as the content and AI-moderation verdicts of unapproved and spam…
PLUGIN
Desktop Mode
CVE-2026-19775
Risk Score
Threat Entry
Updated 2026-09-28
WordPress Core - Security Vulnerability (CVE-2026-87902)
WordPress Core Remote File Inclusion Vulnerability Vendor/Product: WordPress Core Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Notes: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements:…
CORE
WordPress Core
CVE-2026-87902
Risk Score
Threat Entry
Updated 2026-09-24
Custom Thank You Page for WooCommerce - Security Vulnerability (CVE-2026-4806)
The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the save_option() function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or reset(delete) the plugin's settings.
PLUGIN
Custom Thank You Page for WooCommerce
CVE-2026-4806
Risk Score
Threat Entry
Updated 2026-09-24
MailerLite – Signup forms (official) - Security Vulnerability (CVE-2026-3253)
The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms.
PLUGIN
MailerLite – Signup forms (official)
CVE-2026-3253
Risk Score
Threat Entry
Updated 2026-09-24
Spectra Legacy – Gutenberg Blocks - Security Vulnerability (CVE-2026-16302)
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account.
PLUGIN
Spectra Legacy – Gutenberg Blocks
CVE-2026-16302
Risk Score
Threat Entry
Updated 2026-09-24
Kirki – Freeform Page Builder, Website Builder & Customizer - Security Vulnerability (CVE-2026-18335)
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
THEME
Kirki – Freeform Page Builder, Website Builder & Customizer
CVE-2026-18335
Risk Score
Threat Entry
Updated 2026-09-24
WP Multilang – Translation and Multilingual Plugin - Security Vulnerability (CVE-2026-15731)
The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
WP Multilang – Translation and Multilingual Plugin
CVE-2026-15731
Risk Score
Threat Entry
Updated 2026-09-24
Visual Composer Website Builder - Security Vulnerability (CVE-2026-12227)
The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
PLUGIN
Visual Composer Website Builder
CVE-2026-12227
Risk Score
Threat Entry
Updated 2026-09-24
YOP Poll - Security Vulnerability (CVE-2026-85682)
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.
PLUGIN
YOP Poll
CVE-2026-85682
Risk Score
Threat Entry
Updated 2026-09-24
eesy_ID2WP – Publish InDesign HTML5 - Security Vulnerability (CVE-2026-77193)
The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
eesy_ID2WP – Publish InDesign HTML5
CVE-2026-77193
Risk Score