Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90965)
The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published.
PLUGIN
Essential Real Estate
CVE-2026-90965
Risk Score
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90964)
The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site.
PLUGIN
Essential Real Estate
CVE-2026-90964
Risk Score
Threat Entry
Updated 2026-11-06
Essential Real Estate - Security Vulnerability (CVE-2026-90963)
The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
PLUGIN
Essential Real Estate
CVE-2026-90963
Risk Score
Threat Entry
Updated 2026-11-06
Subscriptions for WooCommerce - Security Vulnerability (CVE-2026-87856)
The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content.
PLUGIN
Subscriptions for WooCommerce
CVE-2026-87856
Risk Score
Threat Entry
Updated 2026-11-06
Community Events - Security Vulnerability (CVE-2026-86795)
The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site.
PLUGIN
Community Events
CVE-2026-86795
Risk Score
Threat Entry
Updated 2026-11-06
YITH WooCommerce Gift Cards - Security Vulnerability (CVE-2026-88814)
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time.
PLUGIN
YITH WooCommerce Gift Cards
CVE-2026-88814
Risk Score
Threat Entry
Updated 2026-11-06
One Login WordPress - Security Vulnerability (CVE-2026-19256)
The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators.
PLUGIN
One Login WordPress
CVE-2026-19256
Risk Score
Threat Entry
Updated 2026-11-06
WP Event Manager - Security Vulnerability (CVE-2026-16304)
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled.
PLUGIN
WP Event Manager
CVE-2026-16304
Risk Score
Threat Entry
Updated 2026-11-06
FV Flowplayer Video Player - Security Vulnerability (CVE-2026-85347)
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.
PLUGIN
FV Flowplayer Video Player
CVE-2026-85347
Risk Score
Threat Entry
Updated 2026-11-06
FV Flowplayer Video Player - Security Vulnerability (CVE-2026-85351)
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type.
PLUGIN
FV Flowplayer Video Player
CVE-2026-85351
Risk Score
Threat Entry
Updated 2026-11-06
Tutor LMS - Security Vulnerability (CVE-2026-85570)
The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.
PLUGIN
Tutor LMS
CVE-2026-85570
Risk Score
Threat Entry
Updated 2026-11-06
FV Flowplayer Video Player - Security Vulnerability (CVE-2026-85346)
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts.
PLUGIN
FV Flowplayer Video Player
CVE-2026-85346
Risk Score
Threat Entry
Updated 2026-11-06
WP PageNavi Style - Security Vulnerability (CVE-2026-109150)
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
PLUGIN
WP PageNavi Style
CVE-2026-109150
Risk Score
Threat Entry
Updated 2026-11-06
CatFolders - Security Vulnerability (CVE-2026-107786)
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
PLUGIN
CatFolders
CVE-2026-107786
Risk Score
Threat Entry
Updated 2026-11-06
Dokan - Security Vulnerability (CVE-2026-107774)
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted site-owned sender address when relaying its store contact form, instead placing the unauthenticated submitter's supplied address directly in the message's From header rather than a Reply-To, allowing unauthenticated attackers to make the site email its own vendors with the sender spoofed to an address at the site's own domain (such as its administrator), aligned with the domain's own SPF/DKIM.
PLUGIN
Dokan
CVE-2026-107774
Risk Score
Threat Entry
Updated 2026-11-06
g users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders - Security Vulnerability (CVE-2026-107787)
The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action, allowing users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders WordPress plugin before 2.5.7's user restriction setting.
PLUGIN
g users with a role as low as subscriber to reset the per-user ownership of every media folder and disable the CatFolders
CVE-2026-107787
Risk Score
Threat Entry
Updated 2026-11-06
Dokan - Security Vulnerability (CVE-2026-107775)
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
PLUGIN
Dokan
CVE-2026-107775
Risk Score
Threat Entry
Updated 2026-11-06
IVPAY payments - Security Vulnerability (CVE-2026-100144)
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
PLUGIN
IVPAY payments
CVE-2026-100144
Risk Score
Threat Entry
Updated 2026-11-06
Easy Social Icons - Security Vulnerability (CVE-2026-105259)
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
PLUGIN
Easy Social Icons
CVE-2026-105259
Risk Score
Threat Entry
Updated 2026-11-06
Dokan - Security Vulnerability (CVE-2026-107773)
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.
PLUGIN
Dokan
CVE-2026-107773
Risk Score