Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-4335 - Shortpixel Image Optimiser Plugin
The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment post_title in all versions up to, and including, 6.4.3. This is due to insufficient output escaping in the getEditorPopup() function and its corresponding media-popup.php template. Specifically, the attachment's post_title is retrieved from the database via get_post() in AjaxController.php (line 435) and passed directly to the view template (line 449), where it is rendered into an HTML input element's value attribute without esc_attr() escaping (media-popup.php line 139). Since WordPress allows Authors to set arbitrary attachment…
PLUGIN
Shortpixel Image Optimiser
CVE-2026-4335
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-3328 - Acf Frontend Form Element Plugin
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to PHP Object Injection via deserialization of the 'post_content' of admin_form posts in all versions up to, and including, 3.28.31. This is due to the use of WordPress's `maybe_unserialize()` function without class restrictions on user-controllable content stored in admin_form post content. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution.
PLUGIN
Acf Frontend Form Element
CVE-2026-3328
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1986 - Bakkbone Florist Companion Plugin
The FloristPress for Woo – Customize your eCommerce store for your Florist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'noresults' parameter in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping on the user supplied 'noresults' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Bakkbone Florist Companion
CVE-2026-1986
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-4484 - Learning Management System Plugin
The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.
PLUGIN
Learning Management System
CVE-2026-4484
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-4758 - Wp Job Portal Plugin
The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Wp Job Portal
CVE-2026-4758
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32573 - Nelio AB Testing Plugin
Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through
PLUGIN
Nelio AB Testing
CVE-2026-32573
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32546 - Restrict Content Plugin
Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through
PLUGIN
Restrict Content
CVE-2026-32546
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32545 - Taboola Pixel Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Taboola Taboola Pixel taboola-pixel allows Reflected XSS.This issue affects Taboola Pixel: from n/a through
PLUGIN
Taboola Pixel
CVE-2026-32545
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32544 - OOPSpam Anti-Spam Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OOPSpam Team OOPSpam Anti-Spam oopspam-anti-spam allows Stored XSS.This issue affects OOPSpam Anti-Spam: from n/a through
PLUGIN
OOPSpam Anti-Spam
CVE-2026-32544
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32542 - Fusion Builder Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Reflected XSS.This issue affects Fusion Builder: from n/a through < 3.15.0.
PLUGIN
Fusion Builder
CVE-2026-32542
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32567 - YML for Yandex Market Plugin
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in icopydoc YML for Yandex Market yml-for-yandex-market allows Path Traversal.This issue affects YML for Yandex Market: from n/a through < 5.3.0.
PLUGIN
YML for Yandex Market
CVE-2026-32567
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32562 - PPWP Plugin
Missing Authorization vulnerability in WP Folio Team PPWP password-protect-page allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PPWP: from n/a through
PLUGIN
PPWP
CVE-2026-32562
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32536 - Green Downloads Plugin
Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through
PLUGIN
Green Downloads
CVE-2026-32536
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32539 - PublishPress Revisions Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through
PLUGIN
PublishPress Revisions
CVE-2026-32539
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32534 - JS Help Desk Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through
PLUGIN
JS Help Desk
CVE-2026-32534
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32538 - SMTP Mailer Plugin
Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects SMTP Mailer: from n/a through
PLUGIN
SMTP Mailer
CVE-2026-32538
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32537 - Visual Portfolio, Photo Gallery & Post Grid Plugin
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Portfolio, Photo Gallery & Post Grid: from n/a through
PLUGIN
Visual Portfolio, Photo Gallery & Post Grid
CVE-2026-32537
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32540 - Bookly Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookly Bookly bookly-responsive-appointment-booking-tool allows Reflected XSS.This issue affects Bookly: from n/a through
PLUGIN
Bookly
CVE-2026-32540
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32541 - Premmerce Redirect Manager Plugin
Missing Authorization vulnerability in Premmerce Premmerce Redirect Manager premmerce-redirect-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premmerce Redirect Manager: from n/a through
PLUGIN
Premmerce Redirect Manager
CVE-2026-32541
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-32535 - JS Help Desk Plugin
Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through
PLUGIN
JS Help Desk
CVE-2026-32535
Risk Score