Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-22
Custom Field Template - Security Vulnerability (CVE-2026-12995)
The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to delete arbitrary media attachments site-wide by supplying any numeric attachment ID in the file-field parameter alongside the corresponding delete flag, causing content loss and broken pages. Exploitation requires that the attacker's post is governed by a Custom Field Template containing at least one…
PLUGIN
Custom Field Template
CVE-2026-12995
Risk Score
Threat Entry
Updated 2026-09-22
Ninja Forms - Security Vulnerability (CVE-2026-92438)
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.
PLUGIN
Ninja Forms
CVE-2026-92438
Risk Score
Threat Entry
Updated 2026-09-22
Ninja Forms - Security Vulnerability (CVE-2026-91827)
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
PLUGIN
Ninja Forms
CVE-2026-91827
Risk Score
Threat Entry
Updated 2026-09-22
Ninja Forms - Security Vulnerability (CVE-2026-94504)
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
PLUGIN
Ninja Forms
CVE-2026-94504
Risk Score
Threat Entry
Updated 2026-09-23
Translatepress Multilingual - Security Vulnerability (CVE-2026-89412)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can seed the translation dictionary's original column with executable HTML because the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence,…
PLUGIN
Translatepress Multilingual
CVE-2026-89412
Risk Score
Threat Entry
Updated 2026-09-22
Text Styler - Security Vulnerability (CVE-2026-88788)
The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that executes in the browser of anyone viewing the affected post, including administrators.
PLUGIN
Text Styler
CVE-2026-88788
Risk Score
Threat Entry
Updated 2026-09-22
Contextual Related Posts - Security Vulnerability (CVE-2026-85653)
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Contextual Related Posts
CVE-2026-85653
Risk Score
Threat Entry
Updated 2026-09-22
Booking Calendar - Security Vulnerability (CVE-2026-93655)
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbc_auto_fill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Booking Calendar
CVE-2026-93655
Risk Score
Threat Entry
Updated 2026-09-22
Cmp Coming Soon Maintenance - Security Vulnerability (CVE-2026-12470)
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to…
PLUGIN
Cmp Coming Soon Maintenance
CVE-2026-12470
Risk Score
Threat Entry
Updated 2026-09-22
Give Tributes - Security Vulnerability (CVE-2026-19658)
The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the…
PLUGIN
Give Tributes
CVE-2026-19658
Risk Score
Threat Entry
Updated 2026-09-22
Meta Box AIO - Security Vulnerability (CVE-2026-13355)
The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditionally overrides the form's target object_id from the GET parameter 'rwmb_frontend_field_object_id' without any authorization check, and Form::process() lacks the user_can_edit() check present in render(), allowing unauthenticated attackers to overwrite the post_content of any page with an arbitrary shortcode via wp_update_post(); the mb-user-profile component then directly trusts the 'role' and 'auto_login' shortcode attributes in the injected…
PLUGIN
Meta Box AIO
CVE-2026-13355
Risk Score
Threat Entry
Updated 2026-09-25
Ditty News Ticker - Security Vulnerability (CVE-2026-93339)
Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.
PLUGIN
Ditty News Ticker
CVE-2026-93339
Risk Score
Threat Entry
Updated 2026-09-21
GiveWP - Security Vulnerability (CVE-2026-85113)
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
PLUGIN
GiveWP
CVE-2026-85113
Risk Score
Threat Entry
Updated 2026-09-22
Payment Gateway for PayPal on WooCommerce - Security Vulnerability (CVE-2026-92400)
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
PLUGIN
Payment Gateway for PayPal on WooCommerce
CVE-2026-92400
Risk Score
Threat Entry
Updated 2026-09-21
To Do List Member - Security Vulnerability (CVE-2026-86802)
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.
PLUGIN
To Do List Member
CVE-2026-86802
Risk Score
Threat Entry
Updated 2026-09-21
RestroPress - Security Vulnerability (CVE-2026-85010)
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
PLUGIN
RestroPress
CVE-2026-85010
Risk Score
Threat Entry
Updated 2026-09-21
Web to Print Online Designer - Security Vulnerability (CVE-2026-82187)
The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.
PLUGIN
Web to Print Online Designer
CVE-2026-82187
Risk Score
Threat Entry
Updated 2026-09-21
Import and export users and customers - Security Vulnerability (CVE-2026-92541)
The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator.
PLUGIN
Import and export users and customers
CVE-2026-92541
Risk Score
Threat Entry
Updated 2026-09-21
Import and export users and customers - Security Vulnerability (CVE-2026-92540)
The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator.
PLUGIN
Import and export users and customers
CVE-2026-92540
Risk Score
Threat Entry
Updated 2026-09-21
Meow Gallery - Security Vulnerability (CVE-2026-92422)
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
PLUGIN
Meow Gallery
CVE-2026-92422
Risk Score