Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-19
Migratico Lite - Security Vulnerability (CVE-2026-62104)
Unauthenticated Remote Code Execution (RCE) in Migratico Lite
PLUGIN
Migratico Lite
CVE-2026-62104
Risk Score
Threat Entry
Updated 2026-09-17
Headless Single Sign On - Security Vulnerability (CVE-2026-62108)
Unauthenticated Broken Authentication in Headless Single Sign On
PLUGIN
Headless Single Sign On
CVE-2026-62108
Risk Score
Threat Entry
Updated 2026-09-17
Asset CleanUp: Page Speed Booster - Security Vulnerability (CVE-2026-66571)
Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster
PLUGIN
Asset CleanUp: Page Speed Booster
CVE-2026-66571
Risk Score
Threat Entry
Updated 2026-09-19
Bdthemes Element Pack Lite - Security Vulnerability (CVE-2026-66574)
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons
PLUGIN
Bdthemes Element Pack Lite
CVE-2026-66574
Risk Score
Threat Entry
Updated 2026-09-17
Jet Tabs - Security Vulnerability (CVE-2026-66573)
Contributor Cross Site Scripting (XSS) in JetTabs
PLUGIN
Jet Tabs
CVE-2026-66573
Risk Score
Threat Entry
Updated 2026-09-19
Jet Blog - Security Vulnerability (CVE-2026-66572)
Contributor Cross Site Scripting (XSS) in JetBlog
PLUGIN
Jet Blog
CVE-2026-66572
Risk Score
Threat Entry
Updated 2026-09-17
Eduadmin Booking - Security Vulnerability (CVE-2026-62101)
Unauthenticated Broken Authentication in EduAdmin Booking
PLUGIN
Eduadmin Booking
CVE-2026-62101
Risk Score
Threat Entry
Updated 2026-09-19
Fluent Security - Security Vulnerability (CVE-2026-78296)
Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2.
PLUGIN
Fluent Security
CVE-2026-78296
Risk Score
Threat Entry
Updated 2026-09-18
Checkout Field Manager (Checkout Manager) for WooCommerce - Security Vulnerability (CVE-2026-87831)
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
PLUGIN
Checkout Field Manager (Checkout Manager) for WooCommerce
CVE-2026-87831
Risk Score
Threat Entry
Updated 2026-09-18
Checkout Field Manager (Checkout Manager) for WooCommerce - Security Vulnerability (CVE-2026-87829)
The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users.
PLUGIN
Checkout Field Manager (Checkout Manager) for WooCommerce
CVE-2026-87829
Risk Score
Threat Entry
Updated 2026-09-18
To Do List Member - Security Vulnerability (CVE-2026-86801)
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.
PLUGIN
To Do List Member
CVE-2026-86801
Risk Score
Threat Entry
Updated 2026-09-20
from 1 - Security Vulnerability (CVE-2026-87963)
The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.
PLUGIN
from 1
CVE-2026-87963
Risk Score
Threat Entry
Updated 2026-09-18
Robokassa payment gateway for Woocommerce - Security Vulnerability (CVE-2026-91017)
The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.
PLUGIN
Robokassa payment gateway for Woocommerce
CVE-2026-91017
Risk Score
Threat Entry
Updated 2026-09-18
Motors - Security Vulnerability (CVE-2026-91016)
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.
PLUGIN
Motors
CVE-2026-91016
Risk Score
Threat Entry
Updated 2026-09-18
Master Addons for Elementor - Security Vulnerability (CVE-2026-91015)
The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site.
PLUGIN
Master Addons for Elementor
CVE-2026-91015
Risk Score
Threat Entry
Updated 2026-09-18
Event Booking Manager for WooCommerce - Security Vulnerability (CVE-2026-91019)
The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys.
PLUGIN
Event Booking Manager for WooCommerce
CVE-2026-91019
Risk Score
Threat Entry
Updated 2026-09-18
wpShopGermany IT-RECHT KANZLEI - Security Vulnerability (CVE-2026-88795)
The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.
PLUGIN
wpShopGermany IT-RECHT KANZLEI
CVE-2026-88795
Risk Score
Threat Entry
Updated 2026-09-18
PuppyFW - Security Vulnerability (CVE-2026-88904)
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.
PLUGIN
PuppyFW
CVE-2026-88904
Risk Score
Threat Entry
Updated 2026-09-18
Realtyna Organic IDX plugin + WPL Real Estate - Security Vulnerability (CVE-2026-91014)
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS).
PLUGIN
Realtyna Organic IDX plugin + WPL Real Estate
CVE-2026-91014
Risk Score
Threat Entry
Updated 2026-09-18
EWWW Image Optimizer - Security Vulnerability (CVE-2026-91011)
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
PLUGIN
EWWW Image Optimizer
CVE-2026-91011
Risk Score