Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-18
Generate PDF using Contact Form 7 - Security Vulnerability (CVE-2026-90984)
The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer performs on submitted form content, allowing unauthenticated users to make the server request internal resources and read the response back through the generated PDF.
PLUGIN
Generate PDF using Contact Form 7
CVE-2026-90984
Risk Score
Threat Entry
Updated 2026-09-18
Really Simple Security - Security Vulnerability (CVE-2026-88798)
The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied address value before using it as a storage key in one of its own options, allowing unauthenticated attackers to grow that option without bound and to slow the site's handling of missing pages.
PLUGIN
Really Simple Security
CVE-2026-88798
Risk Score
Threat Entry
Updated 2026-09-18
on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit - Security Vulnerability (CVE-2026-89008)
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.
PLUGIN
on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit
CVE-2026-89008
Risk Score
Threat Entry
Updated 2026-09-18
Bookit - Security Vulnerability (CVE-2026-89007)
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
PLUGIN
Bookit
CVE-2026-89007
Risk Score
Threat Entry
Updated 2026-09-18
MasterStudy LMS - Security Vulnerability (CVE-2026-88844)
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
PLUGIN
MasterStudy LMS
CVE-2026-88844
Risk Score
Threat Entry
Updated 2026-09-18
VikBooking Hotel Booking Engine & PMS - Security Vulnerability (CVE-2026-85127)
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the conversation.
PLUGIN
VikBooking Hotel Booking Engine & PMS
CVE-2026-85127
Risk Score
Threat Entry
Updated 2026-09-18
Tz Weekly Radio Schedule - Security Vulnerability (CVE-2026-87775)
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
PLUGIN
Tz Weekly Radio Schedule
CVE-2026-87775
Risk Score
Threat Entry
Updated 2026-09-18
Tz Weekly Radio Schedule - Security Vulnerability (CVE-2026-87774)
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
PLUGIN
Tz Weekly Radio Schedule
CVE-2026-87774
Risk Score
Threat Entry
Updated 2026-09-18
Product Question and Answer - Security Vulnerability (CVE-2026-87771)
The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
PLUGIN
Product Question and Answer
CVE-2026-87771
Risk Score
Threat Entry
Updated 2026-09-18
Price Drop Alert for Woo Commerce - Security Vulnerability (CVE-2026-87770)
The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
PLUGIN
Price Drop Alert for Woo Commerce
CVE-2026-87770
Risk Score
Threat Entry
Updated 2026-09-18
wp shortcut link and advertisement baner - Security Vulnerability (CVE-2026-87767)
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
PLUGIN
wp shortcut link and advertisement baner
CVE-2026-87767
Risk Score
Threat Entry
Updated 2026-09-18
Easy Appointments - Security Vulnerability (CVE-2026-87966)
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
PLUGIN
Easy Appointments
CVE-2026-87966
Risk Score
Threat Entry
Updated 2026-09-18
UpsellWP - Security Vulnerability (CVE-2026-85350)
The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price.
PLUGIN
UpsellWP
CVE-2026-85350
Risk Score
Threat Entry
Updated 2026-09-18
Easy Appointments - Security Vulnerability (CVE-2026-87965)
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.
PLUGIN
Easy Appointments
CVE-2026-87965
Risk Score
Threat Entry
Updated 2026-09-18
AF Companion - Security Vulnerability (CVE-2026-84738)
The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.
PLUGIN
AF Companion
CVE-2026-84738
Risk Score
Threat Entry
Updated 2026-09-18
Easy Form Builder by WhiteStudio - Security Vulnerability (CVE-2026-85122)
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.
PLUGIN
Easy Form Builder by WhiteStudio
CVE-2026-85122
Risk Score
Threat Entry
Updated 2026-09-18
All-in-One WP Migration and Backup - Security Vulnerability (CVE-2026-81810)
The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.
PLUGIN
All-in-One WP Migration and Backup
CVE-2026-81810
Risk Score
Threat Entry
Updated 2026-09-18
King Addons for Elementor - Security Vulnerability (CVE-2026-84902)
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those owned by administrators, and to inject JavaScript through a widget setting that is output without escaping, resulting in Stored Cross-Site Scripting that executes in the session of any user who views the affected page.
PLUGIN
King Addons for Elementor
CVE-2026-84902
Risk Score
Threat Entry
Updated 2026-09-18
RestroPress - Security Vulnerability (CVE-2026-85009)
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
PLUGIN
RestroPress
CVE-2026-85009
Risk Score
Threat Entry
Updated 2026-09-18
Easy Form Builder by WhiteStudio - Security Vulnerability (CVE-2026-85123)
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to create WordPress accounts on a site whose owner has disabled registration.
PLUGIN
Easy Form Builder by WhiteStudio
CVE-2026-85123
Risk Score