Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
FV Flowplayer Video Player - Security Vulnerability (CVE-2026-117525)
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.
PLUGIN
FV Flowplayer Video Player
CVE-2026-117525
Risk Score
Threat Entry
Updated 2026-11-07
Soledad - Security Vulnerability (CVE-2026-93902)
The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author//, which is accessible to unauthenticated visitors regardless of…
THEME
Soledad
CVE-2026-93902
Risk Score
Threat Entry
Updated 2026-11-07
Stackable Ultimate Gutenberg Blocks - Security Vulnerability (CVE-2026-9601)
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Stackable Ultimate Gutenberg Blocks
CVE-2026-9601
Risk Score
Threat Entry
Updated 2026-11-08
Tutor - Security Vulnerability (CVE-2026-93779)
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.2 via the init_routes due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read paid course lesson and topic content without enrollment, retrieve quiz answer keys including the is_correct field before attempting a quiz, and enumerate the email addresses, usernames, and registration data of other users including instructors and administrators. Exploitation…
PLUGIN
Tutor
CVE-2026-93779
Risk Score
Threat Entry
Updated 2026-11-07
Stop Spammer Registrations Plugin - Security Vulnerability (CVE-2026-120477)
The Stop Spammers Classic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' POST parameter in versions up to, and including, 2026.6. An unauthenticated POST handled on init stores the attacker-supplied author field (after sanitize_text_field, which does not escape single quotes) into the ss_stop_sp_reg_stats option history. The Log Report admin page then renders that stored value inside a single-quoted JavaScript string within a double-quoted onclick attribute using esc_js(); because esc_js() uses _wp_specialchars with ENT_COMPAT it does not escape single quotes, allowing the stored value to break out…
PLUGIN
Stop Spammer Registrations Plugin
CVE-2026-120477
Risk Score
Threat Entry
Updated 2026-11-08
Affiliate Program Suite - Security Vulnerability (CVE-2026-120043)
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is reachable without any account because the vulnerable code path is triggered via the…
PLUGIN
Affiliate Program Suite
CVE-2026-120043
Risk Score
Threat Entry
Updated 2026-11-07
Translatepress Multilingual - Security Vulnerability (CVE-2026-119167)
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that at least one prior comment from the attacker's name and email pair has been approved under WordPress's default comment_previously_approved moderation setting, and that a…
PLUGIN
Translatepress Multilingual
CVE-2026-119167
Risk Score
Threat Entry
Updated 2026-11-07
Redux Framework - Security Vulnerability (CVE-2026-110534)
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the target site's theme to register a color_scheme field on the user profile via Redux_Users::set_profile(), which causes the nonce to be rendered on /wp-admin/profile.php for every logged-in…
PLUGIN
Redux Framework
CVE-2026-110534
Risk Score
Threat Entry
Updated 2026-11-07
Redux Framework - Security Vulnerability (CVE-2026-110705)
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to export the entire Redux options panel configuration — including API keys, SMTP credentials, licence keys, and third-party tokens — that is otherwise restricted to administrators. Exploitation requires that a theme or plugin registers a Redux import_export field on a user…
PLUGIN
Redux Framework
CVE-2026-110705
Risk Score
Threat Entry
Updated 2026-11-08
Printcart Integration - Security Vulnerability (CVE-2026-19803)
The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequences, and then deriving both the output directory and output file extension via `pathinfo()` from the same attacker-controlled path — with no `stripImage()` call before `writeImage()` is invoked. This makes it possible for unauthenticated attackers to…
PLUGIN
Printcart Integration
CVE-2026-19803
Risk Score
Threat Entry
Updated 2026-11-07
Qode Wishlist For Woocommerce - Security Vulnerability (CVE-2026-121516)
The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by guests because the required wp_rest nonce is publicly emitted to unauthenticated visitors on the /wishlist/ page, and the attacker controls the transient key, meaning the payload is stored…
PLUGIN
Qode Wishlist For Woocommerce
CVE-2026-121516
Risk Score
Threat Entry
Updated 2026-11-07
Optimole Wp - Security Vulnerability (CVE-2026-120739)
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's (missing_srcsets[*][*].s)' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The HMAC signature required to pass the REST endpoint's authorization check is published in plaintext to unauthenticated visitors…
PLUGIN
Optimole Wp
CVE-2026-120739
Risk Score
Threat Entry
Updated 2026-11-07
Optimole Wp - Security Vulnerability (CVE-2026-120677)
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the comment to be approved by an administrator and for the affected post to contain at least…
PLUGIN
Optimole Wp
CVE-2026-120677
Risk Score
Threat Entry
Updated 2026-11-07
Pie Register - Security Vulnerability (CVE-2026-119158)
The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable when public registration is enabled and the registration form includes a Profile Picture field; the attacker registers via the publicly accessible form (nonce is…
PLUGIN
Pie Register
CVE-2026-119158
Risk Score
Threat Entry
Updated 2026-11-08
Profit Products Tables For Woocommerce - Security Vulnerability (CVE-2026-120560)
The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Media Library File Deletion in all versions up to, and including, 2.1.5 This is due to the `get_table_data()` AJAX handler — registered for unauthenticated access via `wp_ajax_nopriv_woot_get_table_data` — performing no nonce verification and no capability check before passing the attacker-supplied `wp_columns_actions` parameter directly to `apply_filters()` alongside an attacker-controlled integer derived from the `table_id` parameter. This makes it possible for unauthenticated attackers to delete any WordPress media library attachment and its underlying file in the uploads…
PLUGIN
Profit Products Tables For Woocommerce
CVE-2026-120560
Risk Score
Threat Entry
Updated 2026-11-08
payever - WooCommerce Gateway - Security Vulnerability (CVE-2026-93754)
The payever – WooCommerce Gateway plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in various versions up to, and including, 4.8.0. Three WooCommerce-API callbacks (payever_set_sandbox_api_keys, payever_toggle_subscription, payever_synchronization_incoming) are registered with no authentication, capability check, or nonce, and the upload_image() routine writes a remotely fetched file to the public uploads directory using an attacker-controlled basename() BEFORE validating the file type. This makes it possible for unauthenticated attackers to write an executable PHP file and achieve remote code execution. NOTE: the token-recovery leg of the full…
PLUGIN
payever - WooCommerce Gateway
CVE-2026-93754
Risk Score
Threat Entry
Updated 2026-11-07
Instagram Slider Widget - Security Vulnerability (CVE-2026-121519)
The Social Slider Feed – Social Media Feed & Gallery Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slidespeed' parameter in all versions up to, and including, 2.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The missing current_user_can() check in the Factory framework's connect() dispatcher allows Subscriber-level users to bypass the manage_options capability gate and both…
PLUGIN
Instagram Slider Widget
CVE-2026-121519
Risk Score
Threat Entry
Updated 2026-11-07
Fv Wordpress Flowplayer - Security Vulnerability (CVE-2026-121515)
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled, and the injected comment must be approved before the script executes for site visitors.
PLUGIN
Fv Wordpress Flowplayer
CVE-2026-121515
Risk Score
Threat Entry
Updated 2026-11-08
Jupiterx Core - Security Vulnerability (CVE-2026-120737)
The Jupiter X Core plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.62.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate and render arbitrary published post types not intended for public listing — including Flamingo CF7 submission records containing submitter names, email addresses, phone numbers, full messages, and IP addresses — and perform meta_query boolean-oracle reads against the postmeta of any published post. Exploitation…
PLUGIN
Jupiterx Core
CVE-2026-120737
Risk Score
Threat Entry
Updated 2026-11-07
Motopress Appointment Lite - Security Vulnerability (CVE-2026-120741)
The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback => '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb->insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web…
PLUGIN
Motopress Appointment Lite
CVE-2026-120741
Risk Score