Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-1581 - Wpforo Forum Plugin
The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Wpforo Forum
CVE-2026-1581
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2718 - Dealia – Request a quote Plugin
The Dealia – Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.8. This is due to the use of `wp_kses()` for output escaping within HTML attribute contexts where `esc_attr()` is required. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Dealia – Request a quote
CVE-2026-2718
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2716 - Client Testimonial Slider Plugin
The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Testimonial Heading' setting in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Client Testimonial Slider
CVE-2026-2716
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1461 - Simple Membership Plugin
The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler. This is due to the plugin only validating webhook signatures when the stripe-webhook-signing-secret setting is configured, which is empty by default. This makes it possible for unauthenticated attackers to forge Stripe webhook events to manipulate membership subscriptions, including reactivating expired memberships without payment or canceling legitimate subscriptions, potentially leading to unauthorized access and service disruption.
PLUGIN
Simple Membership
CVE-2026-1461
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1219 - Mp3 Music Player By Sonaar Plugin
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_track_note_ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view the contents of private posts.
PLUGIN
Mp3 Music Player By Sonaar
CVE-2026-1219
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27094 - CoBlocks Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoDaddy CoBlocks coblocks allows Stored XSS.This issue affects CoBlocks: from n/a through
PLUGIN
CoBlocks
CVE-2026-27094
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27092 - WPAdverts Plugin
Missing Authorization vulnerability in Greg Winiarski WPAdverts wpadverts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPAdverts: from n/a through
PLUGIN
WPAdverts
CVE-2026-27092
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27074 - Shortcoder Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vaakash Shortcoder shortcoder allows Stored XSS.This issue affects Shortcoder: from n/a through
PLUGIN
Shortcoder
CVE-2026-27074
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27069 - Soledad Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This issue affects Soledad: from n/a through
PLUGIN
Soledad
CVE-2026-27069
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27059 - Penci Recipe Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through
PLUGIN
Penci Recipe
CVE-2026-27059
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27058 - Penci Podcast Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Podcast penci-podcast allows DOM-Based XSS.This issue affects Penci Podcast: from n/a through
PLUGIN
Penci Podcast
CVE-2026-27058
Risk Score
Threat Entry
Updated 2026-04-28
CVE-2026-27066 - Live sales notification for WooCommerce Plugin
Missing Authorization vulnerability in PI Web Solution Live sales notification for WooCommerce live-sales-notifications-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live sales notification for WooCommerce: from n/a through
PLUGIN
Live sales notification for WooCommerce
CVE-2026-27066
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27090 - Kenta Companion Plugin
Cross-Site Request Forgery (CSRF) vulnerability in WP Moose Kenta Companion kenta-companion allows Cross Site Request Forgery.This issue affects Kenta Companion: from n/a through
PLUGIN
Kenta Companion
CVE-2026-27090
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27052 - Sales Countdown Timer for WooCommerce and WordPress Theme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion.This issue affects Sales Countdown Timer for WooCommerce and WordPress: from n/a through < 1.1.9.
THEME
Sales Countdown Timer for WooCommerce and WordPress
CVE-2026-27052
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27057 - Penci Filter Everything Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Filter Everything penci-filter-everything allows Stored XSS.This issue affects Penci Filter Everything: from n/a through
PLUGIN
Penci Filter Everything
CVE-2026-27057
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27050 - RealPress Plugin
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress RealPress realpress allows Cross Site Request Forgery.This issue affects RealPress: from n/a through
PLUGIN
RealPress
CVE-2026-27050
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27042 - NotificationX Plugin
Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificationX: from n/a through
PLUGIN
NotificationX
CVE-2026-27042
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27056 - iThemes Sync
Missing Authorization vulnerability in StellarWP iThemes Sync ithemes-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through
THEME
iThemes Sync
CVE-2026-27056
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-27055 - Penci AI SmartContent Creator Plugin
Missing Authorization vulnerability in PenciDesign Penci AI SmartContent Creator penci-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Penci AI SmartContent Creator: from n/a through
PLUGIN
Penci AI SmartContent Creator
CVE-2026-27055
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-25472 - Fusion Builder Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored XSS.This issue affects Fusion Builder: from n/a through
PLUGIN
Fusion Builder
CVE-2026-25472
Risk Score