Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-18
Autopay - Security Vulnerability (CVE-2026-90923)
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders.
PLUGIN
Autopay
CVE-2026-90923
Risk Score
Threat Entry
Updated 2026-09-18
Paid Membership Subscriptions - Security Vulnerability (CVE-2026-90922)
The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount.
PLUGIN
Paid Membership Subscriptions
CVE-2026-90922
Risk Score
Threat Entry
Updated 2026-09-18
Invisible Anti-Spam & CAPTCHA - Security Vulnerability (CVE-2026-91010)
The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored.
PLUGIN
Invisible Anti-Spam & CAPTCHA
CVE-2026-91010
Risk Score
Threat Entry
Updated 2026-09-18
FREE - Security Vulnerability (CVE-2026-91009)
The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products.
PLUGIN
FREE
CVE-2026-91009
Risk Score
Threat Entry
Updated 2026-09-18
Event Booking Manager for WooCommerce - Security Vulnerability (CVE-2026-91008)
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default.
PLUGIN
Event Booking Manager for WooCommerce
CVE-2026-91008
Risk Score
Threat Entry
Updated 2026-09-18
Login with QR - Security Vulnerability (CVE-2026-86710)
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
PLUGIN
Login with QR
CVE-2026-86710
Risk Score
Threat Entry
Updated 2026-09-18
The Pressengine - Security Vulnerability (CVE-2026-86709)
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.
PLUGIN
The Pressengine
CVE-2026-86709
Risk Score
Threat Entry
Updated 2026-09-18
Private Feed Key - Security Vulnerability (CVE-2026-86707)
The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
PLUGIN
Private Feed Key
CVE-2026-86707
Risk Score
Threat Entry
Updated 2026-09-18
Dictionary - Security Vulnerability (CVE-2026-88792)
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry.
PLUGIN
Dictionary
CVE-2026-88792
Risk Score
Threat Entry
Updated 2026-09-18
Dewa Kirim - Security Vulnerability (CVE-2026-87786)
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticated users to store JavaScript that runs in the session of an administrator who later opens the order.
PLUGIN
Dewa Kirim
CVE-2026-87786
Risk Score
Threat Entry
Updated 2026-09-18
HT Mega Addons for Elementor - Security Vulnerability (CVE-2026-86788)
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitrary JavaScript when the content is viewed, including by higher-privileged users who review or publish it.
PLUGIN
HT Mega Addons for Elementor
CVE-2026-86788
Risk Score
Threat Entry
Updated 2026-09-18
Newsletter - Security Vulnerability (CVE-2026-86824)
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking links with an unkeyed hash, allowing an unauthenticated attacker who recovers that key offline to forge tracking links, obtain any subscriber's session token, and read and modify that subscriber's stored personal data.
PLUGIN
Newsletter
CVE-2026-86824
Risk Score
Threat Entry
Updated 2026-09-18
LearnPress - Security Vulnerability (CVE-2026-86446)
The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken without enrolling.
PLUGIN
LearnPress
CVE-2026-86446
Risk Score
Threat Entry
Updated 2026-09-18
Comments Import & Export - Security Vulnerability (CVE-2026-87836)
The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.
PLUGIN
Comments Import & Export
CVE-2026-87836
Risk Score
Threat Entry
Updated 2026-09-18
WPLP Cookie Consent - Security Vulnerability (CVE-2026-85130)
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an administrative screen, allowing unauthenticated users to run arbitrary JavaScript in the session of an administrator who interacts with the logged entry. Only multisite installations are affected.
PLUGIN
WPLP Cookie Consent
CVE-2026-85130
Risk Score
Threat Entry
Updated 2026-09-18
Choose User Role at Registration - Security Vulnerability (CVE-2026-85128)
The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an administrator chose to offer, allowing unauthenticated users to request any role, including administrator, and to be granted it once the request is approved. Exploitation requires the Choose User Role at Registration WordPress plugin before 1.3.3's role selection feature and public account registration to both be enabled.
PLUGIN
Choose User Role at Registration
CVE-2026-85128
Risk Score
Threat Entry
Updated 2026-09-19
Gf Multi Uploader - Security Vulnerability (CVE-2026-87796)
The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Gf Multi Uploader
CVE-2026-87796
Risk Score
Threat Entry
Updated 2026-09-19
Paid Downloads - Security Vulnerability (CVE-2026-87935)
The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded…
PLUGIN
Paid Downloads
CVE-2026-87935
Risk Score
Threat Entry
Updated 2026-09-17
Photo Gallery by 10Web – Mobile-Friendly Image Gallery - Security Vulnerability (CVE-2026-86311)
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
CVE-2026-86311
Risk Score
Threat Entry
Updated 2026-09-18
All In One Wp Migration - Security Vulnerability (CVE-2026-89064)
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the `Ai1wm_Main_Controller::init()` method — registered on the `admin_init` hook, which fires unauthenticated on `admin-ajax.php` and `admin-post.php` requests — reading `$_SERVER['PHP_AUTH_USER']` and `$_SERVER['PHP_AUTH_PW']` from any incoming request and writing them to the `ai1wm_auth_header` option via `update_option()` as a reversible base64-encoded string, with no capability check, nonce verification, `is_user_logged_in()` check, or confirmation that Basic authentication actually succeeded. This makes it possible for unauthenticated attackers to capture…
PLUGIN
All In One Wp Migration
CVE-2026-89064
Risk Score