Threat Entry Updated 2026-06-17

CVE-2026-22345 - Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery Plugin

Deserialization of Untrusted Data vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery new-image-gallery allows Object Injection.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through

PLUGIN Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery

CVE-2026-22345

HIGH CVSS 8.8 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-22344 - FiveStar Plugin

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes FiveStar fivestar allows PHP Local File Inclusion.This issue affects FiveStar: from n/a through

PLUGIN FiveStar

CVE-2026-22344

HIGH CVSS 8.1 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-22350 - PDF for Elementor Forms + Drag And Drop Template Builder Plugin

Missing Authorization vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through

PLUGIN PDF for Elementor Forms + Drag And Drop Template Builder

CVE-2026-22350

MEDIUM CVSS 6.5 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-22341 - Booked Plugin

Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from n/a through

PLUGIN Booked

CVE-2026-22341

MEDIUM CVSS 6.7 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-23

CVE-2025-69385 - Cartify Allows Exploiting Incorrectly Configured Access Control Security Levels Theme

Missing Authorization vulnerability in AgniHD Cartify - WooCommerce Gutenberg WordPress Theme cartify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cartify - WooCommerce Gutenberg WordPress Theme: from n/a through

THEME Cartify Allows Exploiting Incorrectly Configured Access Control Security Levels

CVE-2025-69385

MEDIUM CVSS 6.5 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-23

CVE-2025-69368 - Soho Allows Dom Based Xss Theme

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes SOHO - Photography WordPress Theme soho allows DOM-Based XSS.This issue affects SOHO - Photography WordPress Theme: from n/a through

THEME Soho Allows Dom Based Xss

CVE-2025-69368

HIGH CVSS 7.1 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-23

CVE-2025-69367 - Oyster Allows Dom Based Xss Theme

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3themes Oyster - Photography WordPress Theme oyster allows DOM-Based XSS.This issue affects Oyster - Photography WordPress Theme: from n/a through

THEME Oyster Allows Dom Based Xss

CVE-2025-69367

HIGH CVSS 7.1 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-25

CVE-2025-68837 - ELEX WordPress HelpDesk & Customer Ticketing System Plugin

Missing Authorization vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through

PLUGIN ELEX WordPress HelpDesk & Customer Ticketing System

CVE-2025-68837

MEDIUM CVSS 6.5 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-25

CVE-2025-68028 - GA4WP: Google Analytics for WordPress Plugin

Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through

PLUGIN GA4WP: Google Analytics for WordPress

CVE-2025-68028

MEDIUM CVSS 6.5 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-2486 - Master Addons For Elementor Plugin

The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Master Addons For Elementor

CVE-2026-2486

MEDIUM CVSS 6.4 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-26370 - Survey Maker Plugin

WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.

PLUGIN Survey Maker

CVE-2026-26370

MEDIUM CVSS 5.1 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-2384 - Quiz Maker Plugin

The Quiz Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `vc_quizmaker` shortcode in all versions up to, and including, 6.7.1.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This vulnerability requires WPBakery Page Builder to be installed and active

PLUGIN Quiz Maker

CVE-2026-2384

MEDIUM CVSS 6.4 2026-02-20

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27440 - myCred Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal myCred mycred allows Stored XSS.This issue affects myCred: from n/a through

PLUGIN myCred

CVE-2026-27440

MEDIUM CVSS 6.5 2026-02-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27387 - DirectoryPress Plugin

Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through

PLUGIN DirectoryPress

CVE-2026-27387

MEDIUM CVSS 5.4 2026-02-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27368 - Coming Soon Page, Under Construction & Maintenance Mode by SeedProd Plugin

Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through

PLUGIN Coming Soon Page, Under Construction & Maintenance Mode by SeedProd

CVE-2026-27368

MEDIUM CVSS 5.3 2026-02-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27343 - Airtifact Plugin

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VanKarWai Airtifact airtifact allows PHP Local File Inclusion.This issue affects Airtifact: from n/a through

PLUGIN Airtifact

CVE-2026-27343

HIGH CVSS 7.5 2026-02-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27360 - Photo Gallery by 10Web Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through

PLUGIN Photo Gallery by 10Web

CVE-2026-27360

MEDIUM CVSS 5.9 2026-02-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27328 - EduBlink Plugin

Missing Authorization vulnerability in DevsBlink EduBlink edublink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduBlink: from n/a through

PLUGIN EduBlink

CVE-2026-27328

MEDIUM CVSS 5.3 2026-02-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27327 - YayMail – WooCommerce Email Customizer Plugin

Missing Authorization vulnerability in YayCommerce YayMail – WooCommerce Email Customizer yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail – WooCommerce Email Customizer: from n/a through

PLUGIN YayMail – WooCommerce Email Customizer

CVE-2026-27327

MEDIUM CVSS 4.3 2026-02-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-2232 - Product Table And List Builder For Woocommerce Lite Plugin

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN Product Table And List Builder For Woocommerce Lite

CVE-2026-2232

HIGH CVSS 7.5 2026-02-19

Risk Score

Open Full Technical Breakdown