Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-15
Buddypress Media - Security Vulnerability (CVE-2026-16482)
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is exploitable on any public page containing an rtMedia shortcode (e.g., [rtmedia_gallery]) when the…
PLUGIN
Buddypress Media
CVE-2026-16482
Risk Score
Threat Entry
Updated 2026-09-14
Royal Elementor Addons - Security Vulnerability (CVE-2026-17585)
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1066 via the 'wpr_keyword' parameter. This makes it possible for unauthenticated attackers to extract arbitrary postmeta values from all published posts via character-by-character substring matching across the entire wp_postmeta table. The required nonce is emitted publicly via wp_localize_script on any frontend page that loads a Royal Elementor widget, meaning no authenticated session or prior action is needed to obtain it.
PLUGIN
Royal Elementor Addons
CVE-2026-17585
Risk Score
Threat Entry
Updated 2026-09-14
Dt Lms Lite - Security Vulnerability (CVE-2026-11355)
The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings, which can be…
PLUGIN
Dt Lms Lite
CVE-2026-11355
Risk Score
Threat Entry
Updated 2026-09-14
Rox Appointment Booking - Security Vulnerability (CVE-2026-87891)
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.
PLUGIN
Rox Appointment Booking
CVE-2026-87891
Risk Score
Threat Entry
Updated 2026-09-14
WPBot - Security Vulnerability (CVE-2026-87918)
The WPBot WordPress plugin before 8.5.7 does not perform any authorization or nonce check on several AJAX actions that relay prompts to its configured AI providers, allowing unauthenticated attackers to make those third-party API calls, and consume the associated cost, using the site's own configured API keys.
PLUGIN
WPBot
CVE-2026-87918
Risk Score
Threat Entry
Updated 2026-09-14
WPBot - Security Vulnerability (CVE-2026-87916)
The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range.
PLUGIN
WPBot
CVE-2026-87916
Risk Score
Threat Entry
Updated 2026-09-14
Rox Appointment Booking - Security Vulnerability (CVE-2026-87894)
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
PLUGIN
Rox Appointment Booking
CVE-2026-87894
Risk Score
Threat Entry
Updated 2026-09-14
Rox Appointment Booking - Security Vulnerability (CVE-2026-87892)
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.
PLUGIN
Rox Appointment Booking
CVE-2026-87892
Risk Score
Threat Entry
Updated 2026-09-14
Product XML Feed Manager for WooCommerce - Security Vulnerability (CVE-2026-87919)
The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the user's capability over the targeted product, allowing users with contributor-level access to delete arbitrary WooCommerce products by previewing a post that contains the shortcode.
PLUGIN
Product XML Feed Manager for WooCommerce
CVE-2026-87919
Risk Score
Threat Entry
Updated 2026-09-14
WP Component - Security Vulnerability (CVE-2026-85681)
The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator.
PLUGIN
WP Component
CVE-2026-85681
Risk Score
Threat Entry
Updated 2026-09-14
WP images upload on piclect - Security Vulnerability (CVE-2026-84171)
The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.
PLUGIN
WP images upload on piclect
CVE-2026-84171
Risk Score
Threat Entry
Updated 2026-09-14
Add User Autocomplete - Security Vulnerability (CVE-2026-87759)
The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.
PLUGIN
Add User Autocomplete
CVE-2026-87759
Risk Score
Threat Entry
Updated 2026-09-14
Wpstorecart - Security Vulnerability (CVE-2026-84099)
The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.
PLUGIN
Wpstorecart
CVE-2026-84099
Risk Score
Threat Entry
Updated 2026-09-14
subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing - Security Vulnerability (CVE-2026-87888)
The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.
PLUGIN
subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing
CVE-2026-87888
Risk Score
Threat Entry
Updated 2026-09-14
Zonify - Security Vulnerability (CVE-2026-87842)
The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.
PLUGIN
Zonify
CVE-2026-87842
Risk Score
Threat Entry
Updated 2026-09-14
WP Highlight Box - Security Vulnerability (CVE-2026-86790)
The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
WP Highlight Box
CVE-2026-86790
Risk Score
Threat Entry
Updated 2026-09-14
Sprout Invoices - Security Vulnerability (CVE-2026-87797)
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.
PLUGIN
Sprout Invoices
CVE-2026-87797
Risk Score
Threat Entry
Updated 2026-09-14
Masteriyo LMS - Security Vulnerability (CVE-2026-82845)
The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the same issue is reachable without an account and yields an arbitrary file write rather than code execution.
PLUGIN
Masteriyo LMS
CVE-2026-82845
Risk Score
Threat Entry
Updated 2026-09-14
Album Cover Finder - Security Vulnerability (CVE-2026-84047)
The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
PLUGIN
Album Cover Finder
CVE-2026-84047
Risk Score
Threat Entry
Updated 2026-09-14
Custom Menu Wizard Widget - Security Vulnerability (CVE-2026-83532)
The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.
PLUGIN
Custom Menu Wizard Widget
CVE-2026-83532
Risk Score