Threat Entry Updated 2026-06-17

CVE-2026-27985 - Humanum Plugin

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Humanum humanum allows PHP Local File Inclusion.This issue affects Humanum: from n/a through

PLUGIN Humanum

CVE-2026-27985

HIGH CVSS 8.1 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27439 - Dentario Plugin

Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through

PLUGIN Dentario

CVE-2026-27439

CRITICAL CVSS 9.8 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27438 - Kingler Plugin

Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through

PLUGIN Kingler

CVE-2026-27438

CRITICAL CVSS 9.8 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27437 - Tennis Club Plugin

Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through

PLUGIN Tennis Club

CVE-2026-27437

CRITICAL CVSS 9.8 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27417 - Sweet Date Plugin

Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.

PLUGIN Sweet Date

CVE-2026-27417

CRITICAL CVSS 9.8 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27428 - Eagle Booking Plugin

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eagle-Themes Eagle Booking eagle-booking allows SQL Injection.This issue affects Eagle Booking: from n/a through

PLUGIN Eagle Booking

CVE-2026-27428

HIGH CVSS 8.5 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27541 - Wholesale Suite Plugin

Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through

PLUGIN Wholesale Suite

CVE-2026-27541

HIGH CVSS 7.2 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27411 - SiteGuard WP Plugin

Guessable CAPTCHA vulnerability in jp-secure SiteGuard WP Plugin siteguard allows Functionality Bypass.This issue affects SiteGuard WP Plugin: from n/a through

PLUGIN SiteGuard WP Plugin

CVE-2026-27411

MEDIUM CVSS 5.4 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27389 - WeDesignTech Ultimate Booking Addon Plugin

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through

PLUGIN WeDesignTech Ultimate Booking Addon

CVE-2026-27389

CRITICAL CVSS 9.8 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27390 - WeDesignTech Ultimate Booking Addon Plugin

Authentication Bypass Using an Alternate Path or Channel vulnerability in designthemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Authentication Abuse.This issue affects WeDesignTech Ultimate Booking Addon: from n/a through

PLUGIN WeDesignTech Ultimate Booking Addon

CVE-2026-27390

HIGH CVSS 8.8 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27406 - My Tickets Plugin

Insertion of Sensitive Information Into Sent Data vulnerability in Joe Dolson My Tickets my-tickets allows Retrieve Embedded Sensitive Data.This issue affects My Tickets: from n/a through

PLUGIN My Tickets

CVE-2026-27406

HIGH CVSS 7.5 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27388 - DesignThemes Booking Manager

Missing Authorization vulnerability in designthemes DesignThemes Booking Manager designthemes-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Booking Manager: from n/a through

THEME DesignThemes Booking Manager

CVE-2026-27388

HIGH CVSS 7.5 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27386 - DesignThemes Directory Addon

Missing Authorization vulnerability in designthemes DesignThemes Directory Addon designthemes-directory-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes Directory Addon: from n/a through

THEME DesignThemes Directory Addon

CVE-2026-27386

HIGH CVSS 7.5 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27396 - Directory Pro Plugin

Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directory Pro: from n/a through

PLUGIN Directory Pro

CVE-2026-27396

HIGH CVSS 7.3 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27384 - W3 Total Cache Plugin

Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects W3 Total Cache: from n/a through

PLUGIN W3 Total Cache

CVE-2026-27384

CRITICAL CVSS 9.0 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27379 - NextScripts Plugin

Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through

PLUGIN NextScripts

CVE-2026-27379

HIGH CVSS 8.8 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27383 - Metro Plugin

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through

PLUGIN Metro

CVE-2026-27383

HIGH CVSS 8.1 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27381 - Aora Plugin

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through

PLUGIN Aora

CVE-2026-27381

HIGH CVSS 8.1 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27385 - DesignThemes Portfolio

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio designthemes-portfolio allows Reflected XSS.This issue affects DesignThemes Portfolio: from n/a through

THEME DesignThemes Portfolio

CVE-2026-27385

HIGH CVSS 7.1 2026-03-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27382 - Metro Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through

PLUGIN Metro

CVE-2026-27382

HIGH CVSS 7.1 2026-03-05

Risk Score

Open Full Technical Breakdown