Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-17
Ni WooCommerce Sales Report - Security Vulnerability (CVE-2026-78472)
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks.
PLUGIN
Ni WooCommerce Sales Report
CVE-2026-78472
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76558)
The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the browser of a high privileged user, such as an administrator, viewing that screen.
PLUGIN
WP Import Export Lite
CVE-2026-76558
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76557)
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to perform SQL injection attacks.
PLUGIN
WP Import Export Lite
CVE-2026-76557
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76556)
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL injection attacks.
PLUGIN
WP Import Export Lite
CVE-2026-76556
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76555)
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission to disclose sensitive files from the server, including files located outside the web root. The same code path also relaxes the file-system permissions of any path it is given, whether or not the copy succeeds.
PLUGIN
WP Import Export Lite
CVE-2026-76555
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76553)
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability to delete arbitrary directories, and every file within them, including outside the web root.
PLUGIN
WP Import Export Lite
CVE-2026-76553
Risk Score
Threat Entry
Updated 2026-09-17
Ni WooCommerce Sales Report - Security Vulnerability (CVE-2026-78474)
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not have any authentication or authorisation checks on one of its report-printing routines, allowing unauthenticated users to retrieve WooCommerce order details and customer contact information, to target an individual order, and to search the store's orders by customer name or email address.
PLUGIN
Ni WooCommerce Sales Report
CVE-2026-78474
Risk Score
Threat Entry
Updated 2026-09-17
Eventin - Security Vulnerability (CVE-2026-77702)
The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge.
PLUGIN
Eventin
CVE-2026-77702
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76559)
The WP Import Export Lite WordPress plugin before 3.9.33 does not properly validate URLs before requesting them during the import process, allowing users with the import capability, which administrators hold by default, to make the site issue requests to internal hosts and services and read their responses. This is an incomplete fix for CVE-2026-11397.
PLUGIN
WP Import Export Lite
CVE-2026-76559
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76551)
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.
PLUGIN
WP Import Export Lite
CVE-2026-76551
Risk Score
Threat Entry
Updated 2026-09-17
WP Import Export Lite - Security Vulnerability (CVE-2026-76550)
The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution.
PLUGIN
WP Import Export Lite
CVE-2026-76550
Risk Score
Threat Entry
Updated 2026-09-17
MultiVendorX - Security Vulnerability (CVE-2026-74926)
The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any authenticated user, such as a subscriber, to overwrite any store's details and payout settings and to replace the record of who owns it.
PLUGIN
MultiVendorX
CVE-2026-74926
Risk Score
Threat Entry
Updated 2026-09-17
Bookly Responsive Appointment Booking Tool - Security Vulnerability (CVE-2026-89063)
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details echoed by the assistant — and inject arbitrary messages into any victim conversation that are subsequently replayed to the Cloud AI worker…
PLUGIN
Bookly Responsive Appointment Booking Tool
CVE-2026-89063
Risk Score
Threat Entry
Updated 2026-09-16
Bold Page Builder - Security Vulnerability (CVE-2026-5920)
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter (bt_bb_save_pre) that can be circumvented via null byte injection, combined with insufficient output sanitization of base64-decoded content in the bt_bb_raw_content shortcode handler. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Bold Page Builder
CVE-2026-5920
Risk Score
Threat Entry
Updated 2026-09-18
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots - Security Vulnerability (CVE-2026-18555)
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
CVE-2026-18555
Risk Score
Threat Entry
Updated 2026-09-16
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe - Security Vulnerability (CVE-2026-78088)
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite known files which may lead to remote code execution when certain preconditions are met.
PLUGIN
Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe
CVE-2026-78088
Risk Score
Threat Entry
Updated 2026-09-16
Wp Lister For Ebay - Security Vulnerability (CVE-2026-18595)
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Lister For Ebay
CVE-2026-18595
Risk Score
Threat Entry
Updated 2026-09-17
WP Directory Kit - Security Vulnerability (CVE-2026-16588)
The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
WP Directory Kit
CVE-2026-16588
Risk Score
Threat Entry
Updated 2026-09-16
TrueBooker – Appointment Booking and Scheduler System - Security Vulnerability (CVE-2026-14349)
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
THEME
TrueBooker – Appointment Booking and Scheduler System
CVE-2026-14349
Risk Score
Threat Entry
Updated 2026-09-17
JetFormBuilder — Dynamic Blocks Form Builder - Security Vulnerability (CVE-2026-12793)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.
PLUGIN
JetFormBuilder — Dynamic Blocks Form Builder
CVE-2026-12793
Risk Score