Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-21
Page Builder Wp - Security Vulnerability (CVE-2026-2422)
The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwp_raw_shortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without any sanitization or escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Base64 encoding allows the payload to bypass WordPress's KSES content filtering at…
PLUGIN
Page Builder Wp
CVE-2026-2422
Risk Score
Threat Entry
Updated 2026-09-21
Ibtana - Ecommerce Product Addons - Security Vulnerability (CVE-2026-1984)
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.
PLUGIN
Ibtana - Ecommerce Product Addons
CVE-2026-1984
Risk Score
Threat Entry
Updated 2026-09-21
Metasync - Security Vulnerability (CVE-2026-15947)
The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types…
PLUGIN
Metasync
CVE-2026-15947
Risk Score
Threat Entry
Updated 2026-09-21
Vw Writer Blog - Security Vulnerability (CVE-2026-2278)
The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all theme customizer settings to their defaults.
THEME
Vw Writer Blog
CVE-2026-2278
Risk Score
Threat Entry
Updated 2026-09-21
Blockspare - Security Vulnerability (CVE-2026-1242)
The BlockSpare plugin for WordPress is vulnerable to authorization bypass due to incorrect logic in the permission callback in all versions up to, and including, 4.2.6 due to the use of an AND (&&) operator instead of an OR (||) operator. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass authorization checks and create arbitrary posts.
PLUGIN
Blockspare
CVE-2026-1242
Risk Score
Threat Entry
Updated 2026-09-21
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes - Security Vulnerability (CVE-2026-15664)
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes in the context of the WordPress admin results view, making administrators the primary target when reviewing submitted form entries.
PLUGIN
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
CVE-2026-15664
Risk Score
Threat Entry
Updated 2026-09-21
Mediavine Create - Security Vulnerability (CVE-2026-13200)
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters…
PLUGIN
Mediavine Create
CVE-2026-13200
Risk Score
Threat Entry
Updated 2026-09-21
Mediavine Create - Security Vulnerability (CVE-2026-13191)
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above…
PLUGIN
Mediavine Create
CVE-2026-13191
Risk Score
Threat Entry
Updated 2026-09-21
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder - Security Vulnerability (CVE-2026-15098)
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping in the on_shortcode() and print_global_options() functions: shortcode attribute values are copied verbatim into $this->flipbook_options and then emitted via wp_json_encode() inside a byte sequence in the attribute value to break out of the JSON script context. Because WordPress's shortcode_parse_atts() applies stripcslashes() to attribute values, an attacker can encode the…
PLUGIN
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
CVE-2026-15098
Risk Score
Threat Entry
Updated 2026-09-21
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) - Security Vulnerability (CVE-2026-13770)
The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with…
PLUGIN
AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)
CVE-2026-13770
Risk Score
Threat Entry
Updated 2026-09-21
SSL Zen — SSL Certificate Installer & HTTPS Redirects - Security Vulnerability (CVE-2026-15463)
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage.
PLUGIN
SSL Zen — SSL Certificate Installer & HTTPS Redirects
CVE-2026-15463
Risk Score
Threat Entry
Updated 2026-09-21
Search Atlas SEO - Security Vulnerability (CVE-2026-15946)
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.23. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the whitelabel settings password to an attacker-controlled value, enabling them to unlock whitelabel-protected admin settings tabs including whitelabel, general, and advanced configuration.
PLUGIN
Search Atlas SEO
CVE-2026-15946
Risk Score
Threat Entry
Updated 2026-09-21
Mobile Login Woocommerce - Security Vulnerability (CVE-2026-12402)
The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.
PLUGIN
Mobile Login Woocommerce
CVE-2026-12402
Risk Score
Threat Entry
Updated 2026-09-21
PDF Builder for WooCommerce. Create invoices,packing slips and more - Security Vulnerability (CVE-2026-11899)
The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve invoice numbers, formatted invoice numbers, and creation timestamps for arbitrary WooCommerce orders by supplying any OrderNumber and InvoiceId values with a garbage nonce.
PLUGIN
PDF Builder for WooCommerce. Create invoices,packing slips and more
CVE-2026-11899
Risk Score
Threat Entry
Updated 2026-09-21
Wp Customer Reviews - Security Vulnerability (CVE-2026-11608)
The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Wp Customer Reviews
CVE-2026-11608
Risk Score
Threat Entry
Updated 2026-09-21
Hydra Booking - Security Vulnerability (CVE-2026-92425)
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.
PLUGIN
Hydra Booking
CVE-2026-92425
Risk Score
Threat Entry
Updated 2026-09-21
Mailchimp for WooCommerce - Security Vulnerability (CVE-2026-92435)
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
PLUGIN
Mailchimp for WooCommerce
CVE-2026-92435
Risk Score
Threat Entry
Updated 2026-09-21
for WooCommerce - Security Vulnerability (CVE-2026-92430)
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
PLUGIN
for WooCommerce
CVE-2026-92430
Risk Score
Threat Entry
Updated 2026-09-21
Hydra Booking - Security Vulnerability (CVE-2026-92421)
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the user making the request, allowing authenticated users holding a Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3-assigned host role to modify other hosts' profile data and reassign ownership of another host's record to themselves.
PLUGIN
Hydra Booking
CVE-2026-92421
Risk Score
Threat Entry
Updated 2026-09-21
Botiga Pro - Security Vulnerability (CVE-2026-86591)
The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allows unauthenticated users to store arbitrary web scripts which are then executed on every page of the site's front end, as well as to move arbitrary posts to the trash.
PLUGIN
Botiga Pro
CVE-2026-86591
Risk Score