Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-23
WordPress component - Security Vulnerability (CVE-2026-88974)
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2.
UNKNOWN
WordPress component
CVE-2026-88974
Risk Score
Threat Entry
Updated 2026-09-24
SUMIT Payment Gateway for WooCommerce - Security Vulnerability (CVE-2026-84091)
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
PLUGIN
SUMIT Payment Gateway for WooCommerce
CVE-2026-84091
Risk Score
Threat Entry
Updated 2026-09-23
Paid Membership Subscriptions - Security Vulnerability (CVE-2026-90950)
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.
PLUGIN
Paid Membership Subscriptions
CVE-2026-90950
Risk Score
Threat Entry
Updated 2026-09-23
Paymob for WooCommerce - Security Vulnerability (CVE-2026-87978)
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment.
PLUGIN
Paymob for WooCommerce
CVE-2026-87978
Risk Score
Threat Entry
Updated 2026-09-23
Forminator Forms - Security Vulnerability (CVE-2026-87071)
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates.
PLUGIN
Forminator Forms
CVE-2026-87071
Risk Score
Threat Entry
Updated 2026-09-23
Forminator Forms - Security Vulnerability (CVE-2026-87070)
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
PLUGIN
Forminator Forms
CVE-2026-87070
Risk Score
Threat Entry
Updated 2026-09-23
MPCX Lightbox - Security Vulnerability (CVE-2026-87848)
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones.
PLUGIN
MPCX Lightbox
CVE-2026-87848
Risk Score
Threat Entry
Updated 2026-09-23
Ninja Tables - Security Vulnerability (CVE-2026-86612)
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.
PLUGIN
Ninja Tables
CVE-2026-86612
Risk Score
Threat Entry
Updated 2026-09-23
GTranslate - Security Vulnerability (CVE-2026-86604)
The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.
PLUGIN
GTranslate
CVE-2026-86604
Risk Score
Threat Entry
Updated 2026-09-23
WP Recipe Maker - Security Vulnerability (CVE-2026-86601)
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
PLUGIN
WP Recipe Maker
CVE-2026-86601
Risk Score
Threat Entry
Updated 2026-09-23
Rename Wp Loginphp To Anything You Want - Security Vulnerability (CVE-2026-93368)
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress core applies wp_unslash() to the 'log' POST value before dispatching the wp_login_failed action, stripping magic-quotes…
PLUGIN
Rename Wp Loginphp To Anything You Want
CVE-2026-93368
Risk Score
Threat Entry
Updated 2026-09-23
Advanced Contact form 7 DB - Security Vulnerability (CVE-2026-6831)
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode.
PLUGIN
Advanced Contact form 7 DB
CVE-2026-6831
Risk Score
Threat Entry
Updated 2026-09-23
Getwid - Gutenberg Blocks - Security Vulnerability (CVE-2026-5924)
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval() on user-controlled block content in the frontend JavaScript mapStyles() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Getwid - Gutenberg Blocks
CVE-2026-5924
Risk Score
Threat Entry
Updated 2026-09-23
Premium Packages - Security Vulnerability (CVE-2026-93511)
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.
PLUGIN
Premium Packages
CVE-2026-93511
Risk Score
Threat Entry
Updated 2026-09-23
Points and Rewards for WooCommerce - Security Vulnerability (CVE-2026-93510)
The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance.
PLUGIN
Points and Rewards for WooCommerce
CVE-2026-93510
Risk Score
Threat Entry
Updated 2026-09-23
NP Quote Request for WooCommerce - Security Vulnerability (CVE-2026-93528)
The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.
PLUGIN
NP Quote Request for WooCommerce
CVE-2026-93528
Risk Score
Threat Entry
Updated 2026-09-23
WC Fields Factory - Security Vulnerability (CVE-2026-93508)
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.
PLUGIN
WC Fields Factory
CVE-2026-93508
Risk Score
Threat Entry
Updated 2026-09-23
Subscribe Forms - Security Vulnerability (CVE-2026-91073)
The Subscribe Forms WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators.
PLUGIN
Subscribe Forms
CVE-2026-91073
Risk Score
Threat Entry
Updated 2026-09-23
Booking Manager - Security Vulnerability (CVE-2026-91024)
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
PLUGIN
Booking Manager
CVE-2026-91024
Risk Score
Threat Entry
Updated 2026-09-23
WPC Smart Compare for WooCommerce - Security Vulnerability (CVE-2026-90985)
The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products.
PLUGIN
WPC Smart Compare for WooCommerce
CVE-2026-90985
Risk Score