Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-21
Master Blocks - Security Vulnerability (CVE-2026-88824)
The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page.
PLUGIN
Master Blocks
CVE-2026-88824
Risk Score
Threat Entry
Updated 2026-09-21
VikRentItems Flexible Rental Management System - Security Vulnerability (CVE-2026-88926)
The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.
PLUGIN
VikRentItems Flexible Rental Management System
CVE-2026-88926
Risk Score
Threat Entry
Updated 2026-09-21
UsersWP - Security Vulnerability (CVE-2026-86814)
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
PLUGIN
UsersWP
CVE-2026-86814
Risk Score
Threat Entry
Updated 2026-09-21
MgoSync - Security Vulnerability (CVE-2026-92404)
The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, from a configured site.
PLUGIN
MgoSync
CVE-2026-92404
Risk Score
Threat Entry
Updated 2026-09-21
WPGraphQL Smart Cache - Security Vulnerability (CVE-2026-92099)
The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own frontend registers them.
PLUGIN
WPGraphQL Smart Cache
CVE-2026-92099
Risk Score
Threat Entry
Updated 2026-09-21
Online Scheduling and Appointment Booking System - Security Vulnerability (CVE-2026-91847)
The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.
PLUGIN
Online Scheduling and Appointment Booking System
CVE-2026-91847
Risk Score
Threat Entry
Updated 2026-09-21
Hydra Booking - Security Vulnerability (CVE-2026-92420)
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other providers' bookings on the same site.
PLUGIN
Hydra Booking
CVE-2026-92420
Risk Score
Threat Entry
Updated 2026-09-21
Secure Custom Fields - Security Vulnerability (CVE-2026-92403)
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify the title and content of the post that form is bound to.
PLUGIN
Secure Custom Fields
CVE-2026-92403
Risk Score
Threat Entry
Updated 2026-09-21
Ultimate Member - Security Vulnerability (CVE-2026-85680)
The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.
PLUGIN
Ultimate Member
CVE-2026-85680
Risk Score
Threat Entry
Updated 2026-09-21
Unbounce Landing Pages - Security Vulnerability (CVE-2026-85574)
The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.
PLUGIN
Unbounce Landing Pages
CVE-2026-85574
Risk Score
Threat Entry
Updated 2026-09-21
WP Import Export Lite - Security Vulnerability (CVE-2026-76554)
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators.
PLUGIN
WP Import Export Lite
CVE-2026-76554
Risk Score
Threat Entry
Updated 2026-09-21
Estatik Real Estate Plugin - Security Vulnerability (CVE-2026-76790)
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
PLUGIN
Estatik Real Estate Plugin
CVE-2026-76790
Risk Score
Threat Entry
Updated 2026-09-21
Ultra Addons for Contact Form 7 - Security Vulnerability (CVE-2026-84750)
The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP alongside .php and .phtml, so on that stack the uploaded file is executed and the issue leads to Remote Code Execution and full site takeover. Where…
PLUGIN
Ultra Addons for Contact Form 7
CVE-2026-84750
Risk Score
Threat Entry
Updated 2026-09-21
JetFormBuilder - Security Vulnerability (CVE-2026-19860)
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.
PLUGIN
JetFormBuilder
CVE-2026-19860
Risk Score
Threat Entry
Updated 2026-09-21
Nimble Page Builder - Security Vulnerability (CVE-2026-16557)
The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-builder content of arbitrary non-public (draft, pending, private, scheduled) posts and pages.
PLUGIN
Nimble Page Builder
CVE-2026-16557
Risk Score
Threat Entry
Updated 2026-09-21
Pochipp - Security Vulnerability (CVE-2026-92967)
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $_GET['keyword'], applies only sanitize_text_field() (which strips tags but leaves double quotes intact) and interpolates the value directly into the value attribute of the search input via a PHP heredoc, without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user with upload_files capability (Author…
PLUGIN
Pochipp
CVE-2026-92967
Risk Score
Threat Entry
Updated 2026-09-21
The Forminator Forms - Security Vulnerability (CVE-2026-92229)
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
The Forminator Forms
CVE-2026-92229
Risk Score
Threat Entry
Updated 2026-09-21
Save As Pdf By Pdfcrowd - Security Vulnerability (CVE-2026-92807)
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_callback` shortcode attribute. The `eval_shortcode()` function copies any non-`button_`/non-`email_` shortcode attribute verbatim into a custom options array without sanitization, allowlist enforcement, or capability checks, and `create_button()` AES-encrypts that array — including the attacker-supplied callback value — and embeds the resulting blob in the rendered button HTML; when the blob is later POSTed to the unauthenticated `wp_ajax_nopriv_save_as_pdf_pdfcrowd` endpoint, `save_as_pdf_pdfcrowd()` decrypts it and invokes `$options['pdf_created_callback']` as…
PLUGIN
Save As Pdf By Pdfcrowd
CVE-2026-92807
Risk Score
Threat Entry
Updated 2026-09-21
Wp Recipe Maker - Security Vulnerability (CVE-2026-89274)
The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because `WPRM_Metadata::sanitize_metadata()` recursively calls `do_shortcode()` on every scalar field of the recipe's structured metadata array — including the `reviewBody` field, which is populated verbatim from the `comment_content` of approved `wprm-comment-rating` comments — without sanitizing or stripping shortcode tokens before execution; the subsequent `wp_strip_all_tags()` and `strip_shortcodes()` calls operate only on the output string after execution has already fully occurred, providing no protection against server-side shortcode invocation. This…
PLUGIN
Wp Recipe Maker
CVE-2026-89274
Risk Score
Threat Entry
Updated 2026-09-21
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots - Security Vulnerability (CVE-2026-89334)
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication. This is only exploitable when the chat room's only_joined_can_read setting retains its default…
PLUGIN
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
CVE-2026-89334
Risk Score