Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-16
Advanced Popups - Security Vulnerability (CVE-2026-11996)
The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Advanced Popups
CVE-2026-11996
Risk Score
Threat Entry
Updated 2026-09-16
Ad Inserter – Ad Manager & AdSense Ads - Security Vulnerability (CVE-2026-11984)
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the `ai-debug-code` URL-parameter. This makes it possible for unauthenticated attackers to view administrator-configured header and footer code blocks that have been disabled from public display.
PLUGIN
Ad Inserter – Ad Manager & AdSense Ads
CVE-2026-11984
Risk Score
Threat Entry
Updated 2026-09-24
Wp Rest Api Authentication - Security Vulnerability (CVE-2026-89027)
miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks.
PLUGIN
Wp Rest Api Authentication
CVE-2026-89027
Risk Score
Threat Entry
Updated 2026-09-18
Design Scuole Wordpress Theme - Security Vulnerability (CVE-2026-89307)
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).
THEME
Design Scuole Wordpress Theme
CVE-2026-89307
Risk Score
Threat Entry
Updated 2026-09-18
Design Scuole Wordpress Theme - Security Vulnerability (CVE-2026-87792)
The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator functions, allowing an unauthenticated attacker to access restricted "Circolare" content and registered users' data. An unauthenticated RSS feed at /circolare/feed/ further facilitates exploitation.
THEME
Design Scuole Wordpress Theme
CVE-2026-87792
Risk Score
Threat Entry
Updated 2026-09-18
Design Scuole Wordpress Theme - Security Vulnerability (CVE-2026-87791)
A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process.
THEME
Design Scuole Wordpress Theme
CVE-2026-87791
Risk Score
Threat Entry
Updated 2026-09-18
Design Scuole Wordpress Theme - Security Vulnerability (CVE-2026-87793)
The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter.
THEME
Design Scuole Wordpress Theme
CVE-2026-87793
Risk Score
Threat Entry
Updated 2026-09-16
MotoPress Hotel Booking - Security Vulnerability (CVE-2026-90650)
The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The premium Stripe webhook listener only verifies the webhook signature when an optional Stripe signing secret has been configured; because that secret is empty by default, a forged webhook is…
PLUGIN
MotoPress Hotel Booking
CVE-2026-90650
Risk Score
Threat Entry
Updated 2026-09-17
Consulting - Security Vulnerability (CVE-2026-14805)
The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value…
THEME
Consulting
CVE-2026-14805
Risk Score
Threat Entry
Updated 2026-09-16
Bridge - Security Vulnerability (CVE-2026-15609)
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Bridge
CVE-2026-15609
Risk Score
Threat Entry
Updated 2026-09-16
Wp Event Solution - Security Vulnerability (CVE-2026-15402)
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Event Solution
CVE-2026-15402
Risk Score
Threat Entry
Updated 2026-09-16
WP Directory Kit - Security Vulnerability (CVE-2026-16593)
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.
PLUGIN
WP Directory Kit
CVE-2026-16593
Risk Score
Threat Entry
Updated 2026-09-16
WP Directory Kit - Security Vulnerability (CVE-2026-18232)
The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.
PLUGIN
WP Directory Kit
CVE-2026-18232
Risk Score
Threat Entry
Updated 2026-09-16
WP Directory Kit - Security Vulnerability (CVE-2026-16592)
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
PLUGIN
WP Directory Kit
CVE-2026-16592
Risk Score
Threat Entry
Updated 2026-09-17
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery - Security Vulnerability (CVE-2026-15758)
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge…
PLUGIN
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery
CVE-2026-15758
Risk Score
Threat Entry
Updated 2026-09-20
Really Simple Ssl - Security Vulnerability (CVE-2026-82519)
Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely by exploiting an unguarded code path in the profile-page update handler. Attackers can submit a crafted POST request without the two-factor-authentication field to skip nonce verification and trigger delete_two_fa_meta(), which resets the grace period anchor timestamp on every login cycle, causing mandatory 2FA enforcement to be deferred indefinitely.
PLUGIN
Really Simple Ssl
CVE-2026-82519
Risk Score
Threat Entry
Updated 2026-09-14
YouTube Embed - Security Vulnerability (CVE-2026-88793)
The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.
PLUGIN
YouTube Embed
CVE-2026-88793
Risk Score
Threat Entry
Updated 2026-09-14
Hoo Companion - Security Vulnerability (CVE-2026-85129)
The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.
PLUGIN
Hoo Companion
CVE-2026-85129
Risk Score
Threat Entry
Updated 2026-09-14
efore 1.7.8.5 and the Mobile Events Manager - Security Vulnerability (CVE-2026-88802)
The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.
PLUGIN
efore 1.7.8.5 and the Mobile Events Manager
CVE-2026-88802
Risk Score
Threat Entry
Updated 2026-09-14
Quads Ads Manager for Google AdSense - Security Vulnerability (CVE-2026-89050)
The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment.
PLUGIN
Quads Ads Manager for Google AdSense
CVE-2026-89050
Risk Score