Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
WCFM Membership - Security Vulnerability (CVE-2026-39744)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Stored XSS.This issue affects WCFM Membership: from n/a through 2.12.0.
PLUGIN
WCFM Membership
CVE-2026-39744
Risk Score
Threat Entry
Updated 2026-11-06
Quick Event Manager - Security Vulnerability (CVE-2026-121636)
The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications before marking event registrations as paid, which could allow unauthenticated attackers to mark registrations as paid without making a payment.
PLUGIN
Quick Event Manager
CVE-2026-121636
Risk Score
Threat Entry
Updated 2026-11-06
OAuth Single Sign On – SSO (OAuth Client) - Security Vulnerability (CVE-2026-120844)
Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.
PLUGIN
OAuth Single Sign On – SSO (OAuth Client)
CVE-2026-120844
Risk Score
Threat Entry
Updated 2026-11-07
Radius Booking — Booking Calendar for Appointments & Services - Security Vulnerability (CVE-2026-119516)
Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.
PLUGIN
Radius Booking — Booking Calendar for Appointments & Services
CVE-2026-119516
Risk Score
Threat Entry
Updated 2026-11-06
FloristPress - Security Vulnerability (CVE-2026-119499)
Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4.
PLUGIN
FloristPress
CVE-2026-119499
Risk Score
Threat Entry
Updated 2026-11-06
Order Tracking - Security Vulnerability (CVE-2026-121633)
The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.
PLUGIN
Order Tracking
CVE-2026-121633
Risk Score
Threat Entry
Updated 2026-11-06
WP Libre Form - Security Vulnerability (CVE-2026-118423)
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
PLUGIN
WP Libre Form
CVE-2026-118423
Risk Score
Threat Entry
Updated 2026-11-06
Pie Register - Security Vulnerability (CVE-2026-119488)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie Register pie-register allows Stored XSS.This issue affects Pie Register: from n/a through 3.8.4.15.
PLUGIN
Pie Register
CVE-2026-119488
Risk Score
Threat Entry
Updated 2026-11-06
Redux Framework - Security Vulnerability (CVE-2026-119472)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson Redux Framework redux-framework allows Stored XSS.This issue affects Redux Framework: from n/a through 4.5.16.
PLUGIN
Redux Framework
CVE-2026-119472
Risk Score
Threat Entry
Updated 2026-11-06
MC4WP: Mailchimp for WordPress - Security Vulnerability (CVE-2026-118166)
The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from being processed as shortcodes when a form is embedded with its block, allowing unauthenticated visitors to execute arbitrary registered shortcodes with attacker-chosen attributes. This requires the site owner to have added a request-derived tag to the form content and to embed the form with the block rather than the classic shortcode.
PLUGIN
MC4WP: Mailchimp for WordPress
CVE-2026-118166
Risk Score
Threat Entry
Updated 2026-11-06
Cool Media Filter - Security Vulnerability (CVE-2026-87784)
The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the capabilities of a role, allowing any authenticated user, such as a subscriber, to grant their own role administrator capabilities and take over the site.
PLUGIN
Cool Media Filter
CVE-2026-87784
Risk Score
Threat Entry
Updated 2026-11-06
Iubenda - Security Vulnerability (CVE-2026-86606)
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any visitor viewing them, including logged in administrators.
PLUGIN
Iubenda
CVE-2026-86606
Risk Score
Threat Entry
Updated 2026-11-06
ShopEngine Gutenberg WooCommerce Builder Blocks Addon - Security Vulnerability (CVE-2026-92396)
The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it.
PLUGIN
ShopEngine Gutenberg WooCommerce Builder Blocks Addon
CVE-2026-92396
Risk Score
Threat Entry
Updated 2026-11-06
WCFM Membership - Security Vulnerability (CVE-2026-12967)
The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid membership, allowing any authenticated Subscriber/Customer to activate a paid vendor membership for free and gain the marketplace vendor role.
PLUGIN
WCFM Membership
CVE-2026-12967
Risk Score
Threat Entry
Updated 2026-11-06
All-in-One Video Gallery - Security Vulnerability (CVE-2026-120408)
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before outputting it in the admin video list, and does not sanitise that value when it is written outside its own editor, allowing users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks against administrators.
PLUGIN
All-in-One Video Gallery
CVE-2026-120408
Risk Score
Threat Entry
Updated 2026-11-06
Surfer - Security Vulnerability (CVE-2026-118639)
The Surfer WordPress plugin before 1.8.1.759 discloses a sensitive API credential to low-privileged users through the post editor page and relies on that same credential as the sole authorization for its privileged REST API, allowing users with contributor-level access and above to read the credential and escalate to publishing arbitrary posts and other privileged actions.
PLUGIN
Surfer
CVE-2026-118639
Risk Score
Threat Entry
Updated 2026-11-06
AutomatorWP - Security Vulnerability (CVE-2026-118239)
The AutomatorWP WordPress plugin before 6.0.7 does not check that the user completing its Zoom and AWeber integration connections is allowed to do so, allowing unauthenticated attackers to replace the stored integration credentials with their own and divert the data the site sends to those services into an account they control. Exploitation requires the integration to already be connected and knowledge of the site's OAuth client identifier.
PLUGIN
AutomatorWP
CVE-2026-118239
Risk Score
Threat Entry
Updated 2026-11-06
All-in-One Video Gallery - Security Vulnerability (CVE-2026-119259)
The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target post before writing its view count and duration meta, allowing unauthenticated visitors to create or change that meta on any post, including private and draft posts, and to inflate the view count without limit.
PLUGIN
All-in-One Video Gallery
CVE-2026-119259
Risk Score
Threat Entry
Updated 2026-11-06
PublishPress Revisions - Security Vulnerability (CVE-2026-118188)
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post.
PLUGIN
PublishPress Revisions
CVE-2026-118188
Risk Score
Threat Entry
Updated 2026-11-06
Static Snapshot - Security Vulnerability (CVE-2026-116533)
The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.
PLUGIN
Static Snapshot
CVE-2026-116533
Risk Score