Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-23
FluentBoards - Security Vulnerability (CVE-2026-89331)
The FluentBoards WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators.
PLUGIN
FluentBoards
CVE-2026-89331
Risk Score
Threat Entry
Updated 2026-09-23
Booking Manager - Security Vulnerability (CVE-2026-91025)
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators.
PLUGIN
Booking Manager
CVE-2026-91025
Risk Score
Threat Entry
Updated 2026-09-23
Paid Membership Subscriptions - Security Vulnerability (CVE-2026-90951)
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.
PLUGIN
Paid Membership Subscriptions
CVE-2026-90951
Risk Score
Threat Entry
Updated 2026-09-23
WC Fields Factory - Security Vulnerability (CVE-2026-93507)
The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy.
PLUGIN
WC Fields Factory
CVE-2026-93507
Risk Score
Threat Entry
Updated 2026-09-23
Event Booking Manager for WooCommerce - Security Vulnerability (CVE-2026-91077)
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.
PLUGIN
Event Booking Manager for WooCommerce
CVE-2026-91077
Risk Score
Threat Entry
Updated 2026-09-23
WP Recipe Maker - Security Vulnerability (CVE-2026-86608)
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.
PLUGIN
WP Recipe Maker
CVE-2026-86608
Risk Score
Threat Entry
Updated 2026-09-23
JSM Show Post Metadata - Security Vulnerability (CVE-2026-88997)
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.
PLUGIN
JSM Show Post Metadata
CVE-2026-88997
Risk Score
Threat Entry
Updated 2026-09-23
Real3D Flipbook - Security Vulnerability (CVE-2026-86842)
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
PLUGIN
Real3D Flipbook
CVE-2026-86842
Risk Score
Threat Entry
Updated 2026-09-23
Product Badge, Label, Countdown Timer for WooCommerce - Security Vulnerability (CVE-2026-88929)
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.
PLUGIN
Product Badge, Label, Countdown Timer for WooCommerce
CVE-2026-88929
Risk Score
Threat Entry
Updated 2026-09-23
Paymob for WooCommerce - Security Vulnerability (CVE-2026-87979)
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts.
PLUGIN
Paymob for WooCommerce
CVE-2026-87979
Risk Score
Threat Entry
Updated 2026-09-23
Social Commerce for WooCommerce - Security Vulnerability (CVE-2026-86785)
The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state.
PLUGIN
Social Commerce for WooCommerce
CVE-2026-86785
Risk Score
Threat Entry
Updated 2026-09-23
Post Grid Gutenberg Blocks - Security Vulnerability (CVE-2026-86783)
The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts.
PLUGIN
Post Grid Gutenberg Blocks
CVE-2026-86783
Risk Score
Threat Entry
Updated 2026-09-23
Paymob for WooCommerce - Security Vulnerability (CVE-2026-87981)
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
PLUGIN
Paymob for WooCommerce
CVE-2026-87981
Risk Score
Threat Entry
Updated 2026-09-23
Forminator Forms - Security Vulnerability (CVE-2026-87074)
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed…
PLUGIN
Forminator Forms
CVE-2026-87074
Risk Score
Threat Entry
Updated 2026-09-23
Forminator Forms - Security Vulnerability (CVE-2026-87069)
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.
PLUGIN
Forminator Forms
CVE-2026-87069
Risk Score
Threat Entry
Updated 2026-09-23
HappyAddons for Elementor - Security Vulnerability (CVE-2026-85006)
The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability.
PLUGIN
HappyAddons for Elementor
CVE-2026-85006
Risk Score
Threat Entry
Updated 2026-09-23
Directorist - Security Vulnerability (CVE-2026-84098)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
PLUGIN
Directorist
CVE-2026-84098
Risk Score
Threat Entry
Updated 2026-09-23
Directorist - Security Vulnerability (CVE-2026-84150)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
PLUGIN
Directorist
CVE-2026-84150
Risk Score
Threat Entry
Updated 2026-09-23
Events Calendar - Security Vulnerability (CVE-2026-84741)
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
PLUGIN
Events Calendar
CVE-2026-84741
Risk Score
Threat Entry
Updated 2026-09-23
Easy Hide Login - Security Vulnerability (CVE-2026-84168)
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page, defeating the Easy Hide Login WordPress plugin before 1.7's core protection.
PLUGIN
Easy Hide Login
CVE-2026-84168
Risk Score