Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-24
Events Manager - Security Vulnerability (CVE-2026-93662)
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
PLUGIN
Events Manager
CVE-2026-93662
Risk Score
Threat Entry
Updated 2026-09-24
MasterStudy LMS - Security Vulnerability (CVE-2026-88843)
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
PLUGIN
MasterStudy LMS
CVE-2026-88843
Risk Score
Threat Entry
Updated 2026-09-24
WPeMatico RSS Feed Fetcher - Security Vulnerability (CVE-2026-89005)
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign.
PLUGIN
WPeMatico RSS Feed Fetcher
CVE-2026-89005
Risk Score
Threat Entry
Updated 2026-09-24
WPeMatico RSS Feed Fetcher - Security Vulnerability (CVE-2026-89002)
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
PLUGIN
WPeMatico RSS Feed Fetcher
CVE-2026-89002
Risk Score
Threat Entry
Updated 2026-09-24
MasterStudy LMS - Security Vulnerability (CVE-2026-88846)
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.
PLUGIN
MasterStudy LMS
CVE-2026-88846
Risk Score
Threat Entry
Updated 2026-09-24
MasterStudy LMS - Security Vulnerability (CVE-2026-88847)
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.
PLUGIN
MasterStudy LMS
CVE-2026-88847
Risk Score
Threat Entry
Updated 2026-09-24
MasterStudy LMS - Security Vulnerability (CVE-2026-88845)
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.
PLUGIN
MasterStudy LMS
CVE-2026-88845
Risk Score
Threat Entry
Updated 2026-09-24
Events Manager - Security Vulnerability (CVE-2026-93661)
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
PLUGIN
Events Manager
CVE-2026-93661
Risk Score
Threat Entry
Updated 2026-09-24
WPeMatico RSS Feed Fetcher - Security Vulnerability (CVE-2026-89004)
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators.
PLUGIN
WPeMatico RSS Feed Fetcher
CVE-2026-89004
Risk Score
Threat Entry
Updated 2026-09-24
wpForo Forum - Security Vulnerability (CVE-2026-80513)
The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769.
PLUGIN
wpForo Forum
CVE-2026-80513
Risk Score
Threat Entry
Updated 2026-09-24
efore 2.13.0 to have declared an oEmbed field, as the CMB2 - Security Vulnerability (CVE-2026-80338)
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege…
PLUGIN
efore 2.13.0 to have declared an oEmbed field, as the CMB2
CVE-2026-80338
Risk Score
Threat Entry
Updated 2026-09-24
10Web Booster - Security Vulnerability (CVE-2026-82195)
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.
PLUGIN
10Web Booster
CVE-2026-82195
Risk Score
Threat Entry
Updated 2026-09-24
Masteriyo LMS - Security Vulnerability (CVE-2026-82850)
The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions.
PLUGIN
Masteriyo LMS
CVE-2026-82850
Risk Score
Threat Entry
Updated 2026-09-24
Masteriyo LMS - Security Vulnerability (CVE-2026-82849)
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once.
PLUGIN
Masteriyo LMS
CVE-2026-82849
Risk Score
Threat Entry
Updated 2026-09-24
Post Grid - Security Vulnerability (CVE-2026-84151)
The Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content.
PLUGIN
Post Grid
CVE-2026-84151
Risk Score
Threat Entry
Updated 2026-09-24
WPForms - Security Vulnerability (CVE-2026-74991)
The WPForms WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account.
PLUGIN
WPForms
CVE-2026-74991
Risk Score
Threat Entry
Updated 2026-09-24
Paytium: Mollie payment forms & donations - Security Vulnerability (CVE-2026-18467)
The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and…
PLUGIN
Paytium: Mollie payment forms & donations
CVE-2026-18467
Risk Score
Threat Entry
Updated 2026-09-24
Import and export users and customers - Security Vulnerability (CVE-2026-86583)
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname…
PLUGIN
Import and export users and customers
CVE-2026-86583
Risk Score
Threat Entry
Updated 2026-09-24
EthPress – Web3 Login - Security Vulnerability (CVE-2026-19125)
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as…
PLUGIN
EthPress – Web3 Login
CVE-2026-19125
Risk Score
Threat Entry
Updated 2026-09-24
W4 Post List - Security Vulnerability (CVE-2026-96826)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6.
PLUGIN
W4 Post List
CVE-2026-96826
Risk Score