Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-03
CryptoPayment Gateway - Security Vulnerability (CVE-2026-81648)
The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.
PLUGIN
CryptoPayment Gateway
CVE-2026-81648
Risk Score
Threat Entry
Updated 2026-09-14
from 1 - Security Vulnerability (CVE-2026-74933)
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.
PLUGIN
from 1
CVE-2026-74933
Risk Score
Threat Entry
Updated 2026-09-14
Really Simple Security - Security Vulnerability (CVE-2026-89080)
The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.
PLUGIN
Really Simple Security
CVE-2026-89080
Risk Score
Threat Entry
Updated 2026-09-14
User Registration & Membership - Security Vulnerability (CVE-2026-86406)
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged role, this leads to privilege escalation up to administrator.
PLUGIN
User Registration & Membership
CVE-2026-86406
Risk Score
Threat Entry
Updated 2026-09-14
Simple Membership - Security Vulnerability (CVE-2026-88764)
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged membership level.
PLUGIN
Simple Membership
CVE-2026-88764
Risk Score
Threat Entry
Updated 2026-09-14
Bookit - Security Vulnerability (CVE-2026-88995)
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.
PLUGIN
Bookit
CVE-2026-88995
Risk Score
Threat Entry
Updated 2026-09-14
User Registration & Membership - Security Vulnerability (CVE-2026-80072)
The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.
PLUGIN
User Registration & Membership
CVE-2026-80072
Risk Score
Threat Entry
Updated 2026-09-14
rtMedia for WordPress, BuddyPress and bbPress - Security Vulnerability (CVE-2026-88912)
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.
PLUGIN
rtMedia for WordPress, BuddyPress and bbPress
CVE-2026-88912
Risk Score
Threat Entry
Updated 2026-09-14
User Registration & Membership - Security Vulnerability (CVE-2026-86407)
The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any registration or purchase has taken place, allowing unauthenticated users to retrieve another user's email address, profile fields, role and membership order details. Exploitation requires the site owner to have added a user smart tag to that page's configurable message, which the shipped default does not contain.
PLUGIN
User Registration & Membership
CVE-2026-86407
Risk Score
Threat Entry
Updated 2026-09-14
User Registration & Membership - Security Vulnerability (CVE-2026-80071)
The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.
PLUGIN
User Registration & Membership
CVE-2026-80071
Risk Score
Threat Entry
Updated 2026-09-14
Contact Form to Chat Apps - Security Vulnerability (CVE-2026-77773)
The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated users to read the submitted entries of any form created with a supported third-party form Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8.
PLUGIN
Contact Form to Chat Apps
CVE-2026-77773
Risk Score
Threat Entry
Updated 2026-09-22
the IEC 60870-5-104 TLS client (Task Mode - Security Vulnerability (CVE-2026-90647)
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.
PLUGIN
the IEC 60870-5-104 TLS client (Task Mode
CVE-2026-90647
Risk Score
Threat Entry
Updated 2026-09-14
MemberPress Corporate Accounts - Security Vulnerability (CVE-2026-15451)
The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.
PLUGIN
MemberPress Corporate Accounts
CVE-2026-15451
Risk Score
Threat Entry
Updated 2026-09-14
Ameliabooking - Security Vulnerability (CVE-2026-10148)
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'load_manually' parameter in the render() methods of classes. This makes it possible for authenticated attackers, with Contributor-level access and above who can use Elementor, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 2.4.8.
PLUGIN
Ameliabooking
CVE-2026-10148
Risk Score
Threat Entry
Updated 2026-09-14
The Events Calendar - Security Vulnerability (CVE-2026-78159)
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has…
PLUGIN
The Events Calendar
CVE-2026-78159
Risk Score
Threat Entry
Updated 2026-09-14
The Events Calendar - Security Vulnerability (CVE-2026-78006)
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML,…
PLUGIN
The Events Calendar
CVE-2026-78006
Risk Score
Threat Entry
Updated 2026-09-15
Tutor - Security Vulnerability (CVE-2026-78175)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back…
PLUGIN
Tutor
CVE-2026-78175
Risk Score
Threat Entry
Updated 2026-09-14
Geo My Wp - Security Vulnerability (CVE-2026-85200)
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. In environments where PEAR is installed with register_argc_argv enabled, this file inclusion…
PLUGIN
Geo My Wp
CVE-2026-85200
Risk Score
Threat Entry
Updated 2026-09-14
Multiple Pages Generator By Porthas - Security Vulnerability (CVE-2026-85198)
The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg_spintax]…
PLUGIN
Multiple Pages Generator By Porthas
CVE-2026-85198
Risk Score
Threat Entry
Updated 2026-09-14
Smart Marketing For Wp - Security Vulnerability (CVE-2026-77161)
The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and including, 5.1.24 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the plugin's sync feature to be enabled (options['enabled']) and get_option('egoi_mapping')…
PLUGIN
Smart Marketing For Wp
CVE-2026-77161
Risk Score