Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
WHIZZ - Security Vulnerability (CVE-2026-115230)
The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.
PLUGIN
WHIZZ
CVE-2026-115230
Risk Score
Threat Entry
Updated 2026-11-06
GS JWT Authentication for WP REST API - Security Vulnerability (CVE-2026-113615)
The GS JWT Authentication for WP REST API WordPress plugin through 1.0.0 does not sanitize or parameterize a request value before using it in SQL queries on several unauthenticated REST routes, allowing unauthenticated attackers to perform SQL injection and obtain an administrator session.
PLUGIN
GS JWT Authentication for WP REST API
CVE-2026-113615
Risk Score
Threat Entry
Updated 2026-11-06
Ever Accounting - Security Vulnerability (CVE-2026-118045)
The Ever Accounting WordPress plugin before 2.3.3 does not restrict the file path supplied to its CSV import routine to an allowed directory, allowing users with its custom Accounting Manager role (which does not have administrator privileges) to delete arbitrary files on the server, such as wp-config.php, which takes the entire site offline.
PLUGIN
Ever Accounting
CVE-2026-118045
Risk Score
Threat Entry
Updated 2026-11-06
Anti-Spam, Spam FireWall by CleanTalk - Security Vulnerability (CVE-2026-115673)
The Anti-Spam, Spam FireWall by CleanTalk WordPress plugin before 6.91 does not escape a commenter-supplied value before outputting it on an administrative spam-review screen, allowing unauthenticated users to inject arbitrary web scripts that execute in the browser of an administrator who reviews flagged comments.
PLUGIN
Anti-Spam, Spam FireWall by CleanTalk
CVE-2026-115673
Risk Score
Threat Entry
Updated 2026-11-06
GutenKit - Security Vulnerability (CVE-2026-114427)
The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.
PLUGIN
GutenKit
CVE-2026-114427
Risk Score
Threat Entry
Updated 2026-11-06
MC4WP: Mailchimp for - Security Vulnerability (CVE-2026-118167)
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
PLUGIN
MC4WP: Mailchimp for
CVE-2026-118167
Risk Score
Threat Entry
Updated 2026-11-06
PublishPress Revisions - Security Vulnerability (CVE-2026-118186)
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.
PLUGIN
PublishPress Revisions
CVE-2026-118186
Risk Score
Threat Entry
Updated 2026-11-06
PublishPress Revisions - Security Vulnerability (CVE-2026-118187)
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.
PLUGIN
PublishPress Revisions
CVE-2026-118187
Risk Score
Threat Entry
Updated 2026-11-06
Placester - Security Vulnerability (CVE-2026-113584)
The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.
PLUGIN
Placester
CVE-2026-113584
Risk Score
Threat Entry
Updated 2026-11-06
Wurdey - Security Vulnerability (CVE-2026-110955)
The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.
PLUGIN
Wurdey
CVE-2026-110955
Risk Score
Threat Entry
Updated 2026-11-06
MCB - Security Vulnerability (CVE-2026-110525)
The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.
PLUGIN
MCB
CVE-2026-110525
Risk Score
Threat Entry
Updated 2026-11-06
Mail Mage - Security Vulnerability (CVE-2026-110532)
The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
PLUGIN
Mail Mage
CVE-2026-110532
Risk Score
Threat Entry
Updated 2026-11-06
Advanced Custom Fields (ACF®) - Security Vulnerability (CVE-2026-110813)
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the browser of any visitor or administrator who views a page rendering the affected field.
PLUGIN
Advanced Custom Fields (ACF®)
CVE-2026-110813
Risk Score
Threat Entry
Updated 2026-11-05
Content Egg - Security Vulnerability (CVE-2026-119751)
Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks, whose permission_check() improperly returns true when no X-WP-Nonce header is supplied. Attackers can supply the post_id and module id of a draft, pending, scheduled, or private post to handle_render(), which lacks a publish-status check, to disclose product titles, destination and affiliate URLs, merchant or domain information, and descriptions.
PLUGIN
Content Egg
CVE-2026-119751
Risk Score
Threat Entry
Updated 2026-11-05
Dokan - Security Vulnerability (CVE-2026-107776)
The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger against the amount actually collected for the payment order, allowing a vendor to clear their outstanding commission debt while paying less than the balance owed when a discount coupon is applied at checkout.
PLUGIN
Dokan
CVE-2026-107776
Risk Score
Threat Entry
Updated 2026-11-05
Security For WooCommerce - Security Vulnerability (CVE-2026-100109)
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role, allowing unauthenticated attackers to create administrator accounts and take over the site.
PLUGIN
Security For WooCommerce
CVE-2026-100109
Risk Score
Threat Entry
Updated 2026-11-06
EWWW Image Optimizer - Security Vulnerability (CVE-2026-91049)
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
PLUGIN
EWWW Image Optimizer
CVE-2026-91049
Risk Score
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90967)
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details.
PLUGIN
Essential Real Estate
CVE-2026-90967
Risk Score
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90966)
The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price.
PLUGIN
Essential Real Estate
CVE-2026-90966
Risk Score
Threat Entry
Updated 2026-11-06
WP Event Manager - Security Vulnerability (CVE-2026-86442)
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events.
PLUGIN
WP Event Manager
CVE-2026-86442
Risk Score