Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-17
GiveWP - Security Vulnerability (CVE-2026-85530)
The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user account linked to one, including an administrator's.
PLUGIN
GiveWP
CVE-2026-85530
Risk Score
Threat Entry
Updated 2026-09-17
Tutor LMS - Security Vulnerability (CVE-2026-85569)
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.
PLUGIN
Tutor LMS
CVE-2026-85569
Risk Score
Threat Entry
Updated 2026-09-17
LearnPress - Security Vulnerability (CVE-2026-86444)
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block are affected.
PLUGIN
LearnPress
CVE-2026-86444
Risk Score
Threat Entry
Updated 2026-09-17
Visualizer - Security Vulnerability (CVE-2026-86784)
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such as an administrator, who reviews the affected chart.
PLUGIN
Visualizer
CVE-2026-86784
Risk Score
Threat Entry
Updated 2026-09-17
LearnPress - Security Vulnerability (CVE-2026-86449)
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.
PLUGIN
LearnPress
CVE-2026-86449
Risk Score
Threat Entry
Updated 2026-09-17
LearnPress - Security Vulnerability (CVE-2026-86447)
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email addresses through the same handler's search filter.
PLUGIN
LearnPress
CVE-2026-86447
Risk Score
Threat Entry
Updated 2026-09-17
type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress - Security Vulnerability (CVE-2026-86445)
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
PLUGIN
type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress
CVE-2026-86445
Risk Score
Threat Entry
Updated 2026-09-17
Formidable Forms - Security Vulnerability (CVE-2026-85641)
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
PLUGIN
Formidable Forms
CVE-2026-85641
Risk Score
Threat Entry
Updated 2026-09-17
Tutor LMS - Security Vulnerability (CVE-2026-85572)
The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.
PLUGIN
Tutor LMS
CVE-2026-85572
Risk Score
Threat Entry
Updated 2026-09-17
FluentBoards - Security Vulnerability (CVE-2026-85349)
The FluentBoards WordPress plugin before 2.0.15 does not properly verify authorization when returning the list of boards a user belongs to, allowing any authenticated user, including a Subscriber with no board access, to disclose the private board memberships of arbitrary users by referencing their user ID.
PLUGIN
FluentBoards
CVE-2026-85349
Risk Score
Threat Entry
Updated 2026-09-17
LearnPress - Security Vulnerability (CVE-2026-86448)
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email addresses.
PLUGIN
LearnPress
CVE-2026-86448
Risk Score
Threat Entry
Updated 2026-09-17
Optimole - Security Vulnerability (CVE-2026-84829)
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.
PLUGIN
Optimole
CVE-2026-84829
Risk Score
Threat Entry
Updated 2026-09-17
Xpro Addons - Security Vulnerability (CVE-2026-84088)
The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browser of anyone who interacts with the affected widget.
PLUGIN
Xpro Addons
CVE-2026-84088
Risk Score
Threat Entry
Updated 2026-09-17
WPLP Cookie Consent - Security Vulnerability (CVE-2026-85131)
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not perform CSRF or capability checks when processing bulk actions on its administration screens, and does not restrict the targeted items to its own records, allowing attackers to make a logged in admin permanently delete arbitrary posts and pages via a crafted request.
PLUGIN
WPLP Cookie Consent
CVE-2026-85131
Risk Score
Threat Entry
Updated 2026-09-17
Schema & Structured Data for WP & AMP - Security Vulnerability (CVE-2026-82125)
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam.
PLUGIN
Schema & Structured Data for WP & AMP
CVE-2026-82125
Risk Score
Threat Entry
Updated 2026-09-17
Schema & Structured Data for WP & AMP - Security Vulnerability (CVE-2026-82124)
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.
PLUGIN
Schema & Structured Data for WP & AMP
CVE-2026-82124
Risk Score
Threat Entry
Updated 2026-09-17
Eventin - Security Vulnerability (CVE-2026-84907)
The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a nonce that is exposed to unauthenticated visitors and never checking that the caller owns the order, allowing unauthenticated attackers to reset any existing order and its attendees to a pending state and thereby invalidate paid tickets.
PLUGIN
Eventin
CVE-2026-84907
Risk Score
Threat Entry
Updated 2026-09-17
Eventin - Security Vulnerability (CVE-2026-84905)
The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level access and above to create new WordPress user accounts that carry capabilities beyond their own, including publishing content and uploading files, and, by supplying an email address they control, to obtain a working login to the created account.
PLUGIN
Eventin
CVE-2026-84905
Risk Score
Threat Entry
Updated 2026-09-17
Schema & Structured Data for WP & AMP - Security Vulnerability (CVE-2026-82126)
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.
PLUGIN
Schema & Structured Data for WP & AMP
CVE-2026-82126
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76552)
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during import, allowing users granted its import permission to store arbitrary files, including executable ones, on the server and achieve remote code execution.
PLUGIN
WP Import Export Lite
CVE-2026-76552
Risk Score