Threat Entry Updated 2026-07-24

CVE-2026-39646 - Leaflet Map Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bozdoz Leaflet Map leaflet-map allows Stored XSS.This issue affects Leaflet Map: from n/a through

PLUGIN Leaflet Map

CVE-2026-39646

MEDIUM CVSS 6.5 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39647 - MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin

Server-Side Request Forgery (SSRF) vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Server Side Request Forgery.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through

PLUGIN MP3 Audio Player for Music, Radio & Podcast by Sonaar

CVE-2026-39647

MEDIUM CVSS 5.4 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39645 - GlobalPayments WooCommerce Plugin

Server-Side Request Forgery (SSRF) vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Server Side Request Forgery.This issue affects GlobalPayments WooCommerce: from n/a through

PLUGIN GlobalPayments WooCommerce

CVE-2026-39645

MEDIUM CVSS 5.4 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39649 - Royale News Plugin

Missing Authorization vulnerability in themebeez Royale News royale-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royale News: from n/a through

PLUGIN Royale News

CVE-2026-39649

MEDIUM CVSS 5.3 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39648 - Cream Blog Plugin

Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cream Blog: from n/a through

PLUGIN Cream Blog

CVE-2026-39648

MEDIUM CVSS 5.3 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39644 - Wp Ultimate Review Plugin

Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp Ultimate Review: from n/a through

PLUGIN Wp Ultimate Review

CVE-2026-39644

MEDIUM CVSS 5.3 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39643 - Payment Plugins for PayPal WooCommerce

Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Plugins for PayPal WooCommerce: from n/a through

PLUGIN Payment Plugins for PayPal WooCommerce

CVE-2026-39643

MEDIUM CVSS 5.3 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39640 - Theme Editor

Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through

THEME Theme Editor

CVE-2026-39640

CRITICAL CVSS 9.6 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39641 - Blackfyre Plugin

Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyre allows Cross Site Request Forgery.This issue affects Blackfyre: from n/a through

PLUGIN Blackfyre

CVE-2026-39641

MEDIUM CVSS 6.5 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39639 - RPS Include Content Plugin

Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-include-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RPS Include Content: from n/a through

PLUGIN RPS Include Content

CVE-2026-39639

MEDIUM CVSS 6.5 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39636 - Livemesh Addons for Elementor Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Elementor addons-for-elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through

PLUGIN Livemesh Addons for Elementor

CVE-2026-39636

MEDIUM CVSS 6.5 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39638 - Qubely Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affects Qubely: from n/a through

PLUGIN Qubely

CVE-2026-39638

MEDIUM CVSS 5.9 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-20

CVE-2026-39635 - Grand Magazine Plugin

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through

PLUGIN Grand Magazine

CVE-2026-39635

MEDIUM CVSS 5.4 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39634 - Grand Portfolio Plugin

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through

PLUGIN Grand Portfolio

CVE-2026-39634

MEDIUM CVSS 5.4 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39637 - Mogi Plugin

Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from n/a through

PLUGIN Mogi

CVE-2026-39637

MEDIUM CVSS 5.3 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39633 - Grand Car Rental Plugin

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Rental: from n/a through

PLUGIN Grand Car Rental

CVE-2026-39633

MEDIUM CVSS 6.5 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39632 - Grand Blog Plugin

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through

PLUGIN Grand Blog

CVE-2026-39632

MEDIUM CVSS 6.5 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39630 - Getty Images Plugin

Server-Side Request Forgery (SSRF) vulnerability in Getty Images Getty Images getty-images allows Server Side Request Forgery.This issue affects Getty Images: from n/a through

PLUGIN Getty Images

CVE-2026-39630

MEDIUM CVSS 6.4 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39629 - Uminex Plugin

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes Uminex uminex allows Code Injection.This issue affects Uminex: from n/a through

PLUGIN Uminex

CVE-2026-39629

MEDIUM CVSS 5.3 2026-04-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-24

CVE-2026-39628 - DukaMarket Plugin

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in kutethemes DukaMarket dukamarket allows Code Injection.This issue affects DukaMarket: from n/a through

PLUGIN DukaMarket

CVE-2026-39628

MEDIUM CVSS 5.3 2026-04-08

Risk Score

Open Full Technical Breakdown