Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-22
TikTok - Security Vulnerability (CVE-2026-92965)
The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator's sign-in.
PLUGIN
TikTok
CVE-2026-92965
Risk Score
Threat Entry
Updated 2026-09-21
Meow Gallery - Security Vulnerability (CVE-2026-92423)
The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own posts before returning post data, allowing authenticated users with Author-level access and above to disclose the titles, authors, dates and statuses of other users' draft and private posts.
PLUGIN
Meow Gallery
CVE-2026-92423
Risk Score
Threat Entry
Updated 2026-09-21
Forminator Forms - Security Vulnerability (CVE-2026-87067)
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
PLUGIN
Forminator Forms
CVE-2026-87067
Risk Score
Threat Entry
Updated 2026-09-21
SAML Single Sign On - Security Vulnerability (CVE-2026-82842)
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
PLUGIN
SAML Single Sign On
CVE-2026-82842
Risk Score
Threat Entry
Updated 2026-09-21
Tripzzy - Security Vulnerability (CVE-2026-87839)
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
PLUGIN
Tripzzy
CVE-2026-87839
Risk Score
Threat Entry
Updated 2026-09-21
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-85017)
The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes attacker-controlled stored data through it, which makes it possible for authenticated attackers with subscriber-level access to inject arbitrary PHP objects. A partial fix in the 2.0.18 to 2.0.19 releases raised the privilege required to reach the vulnerable action to editor-level, and the issue was fully resolved in 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-85017
Risk Score
Threat Entry
Updated 2026-09-21
Kirki - Security Vulnerability (CVE-2026-84223)
The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with author-level access and above to upload a file containing JavaScript which is then served from the site's own origin and runs in the session of anyone who opens it.
PLUGIN
Kirki
CVE-2026-84223
Risk Score
Threat Entry
Updated 2026-09-21
Forminator Forms - Security Vulnerability (CVE-2026-87068)
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
PLUGIN
Forminator Forms
CVE-2026-87068
Risk Score
Threat Entry
Updated 2026-09-21
booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy - Security Vulnerability (CVE-2026-87840)
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
PLUGIN
booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy
CVE-2026-87840
Risk Score
Threat Entry
Updated 2026-09-21
Sign-up Sheets - Security Vulnerability (CVE-2026-92410)
The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowing attackers to delete sign-up records via a forged request handled in the session of a logged-in user with the required capability.
PLUGIN
Sign-up Sheets
CVE-2026-92410
Risk Score
Threat Entry
Updated 2026-09-21
Photo Gallery, Sliders, Proofing and - Security Vulnerability (CVE-2026-81650)
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive, due to a variable being reused as a loop counter so that the check always passes, allowing users granted its gallery-management capability by an administrator to write arbitrary files into a web-accessible directory and, on hosts that execute them, run arbitrary code.
PLUGIN
Photo Gallery, Sliders, Proofing and
CVE-2026-81650
Risk Score
Threat Entry
Updated 2026-09-21
Photo Gallery, Sliders, Proofing and - Security Vulnerability (CVE-2026-81653)
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images in galleries belonging to other users.
PLUGIN
Photo Gallery, Sliders, Proofing and
CVE-2026-81653
Risk Score
Threat Entry
Updated 2026-09-21
Import and export users and customers - Security Vulnerability (CVE-2026-16542)
The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks.
PLUGIN
Import and export users and customers
CVE-2026-16542
Risk Score
Threat Entry
Updated 2026-09-21
Photo Gallery, Sliders, Proofing and - Security Vulnerability (CVE-2026-81654)
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change settings that apply across the whole site.
PLUGIN
Photo Gallery, Sliders, Proofing and
CVE-2026-81654
Risk Score
Threat Entry
Updated 2026-09-21
Photo Gallery, Sliders, Proofing and - Security Vulnerability (CVE-2026-81651)
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path, and including galleries belonging to other users.
PLUGIN
Photo Gallery, Sliders, Proofing and
CVE-2026-81651
Risk Score
Threat Entry
Updated 2026-09-21
Photo Gallery, Sliders, Proofing and - Security Vulnerability (CVE-2026-81652)
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any image on the site, including images in galleries belonging to other users. The disclosed data includes the image's stored EXIF subset, covering camera make and model and capture timestamp, along with internal checksums and identifiers that the Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0's own capability-gated…
PLUGIN
Photo Gallery, Sliders, Proofing and
CVE-2026-81652
Risk Score
Threat Entry
Updated 2026-09-21
Master Slider - Security Vulnerability (CVE-2026-14844)
The Master Slider WordPress plugin through 3.11.2 does not sanitise and escape some of its shortcode attributes before outputting them in an inline script context, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when the affected post is viewed. No fixed version is available. Until one ships, restrict the Contributor role to trusted users, or deactivate the Master Slider WordPress plugin through 3.11.2. Site owners who need to keep it active can block the ms_slider shortcode for roles below Editor,…
PLUGIN
Master Slider
CVE-2026-14844
Risk Score
Threat Entry
Updated 2026-09-21
Wc Partial Shipment - Security Vulnerability (CVE-2026-9858)
The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. This is due to the AJAX handlers in woocommerce-partial-shipment.php (registered at lines 60–62 and implemented at lines 228, 263, and 291) lacking both capability checks and nonce verification, and not validating the calling user's ownership of the supplied order_id. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order item details (names, quantities, shipped counts) belonging…
PLUGIN
Wc Partial Shipment
CVE-2026-9858
Risk Score
Threat Entry
Updated 2026-09-21
Empik For Woocommerce - Security Vulnerability (CVE-2026-9766)
The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify arbitrary WooCommerce product metadata, including Empik logistic class (_empik_logistic_klass), product state (_empik_product_state, _empik_product_state_all_variants), and Empik export and offer flags on any product in the store.
PLUGIN
Empik For Woocommerce
CVE-2026-9766
Risk Score
Threat Entry
Updated 2026-09-21
Datalogics Ecommerce Delivery - Security Vulnerability (CVE-2026-9613)
The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to create and cancel real shipping orders through the external logistics API using the store's stored authentication token, modify arbitrary WooCommerce order post meta on any order, overwrite the plugin's stored API token, and trigger shipping notification emails…
PLUGIN
Datalogics Ecommerce Delivery
CVE-2026-9613
Risk Score