Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-24392 - HurryTimer Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Stored XSS.This issue affects HurryTimer: from n/a through
PLUGIN
HurryTimer
CVE-2026-24392
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-23804 - Better Business Reviews Plugin
Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through
PLUGIN
Better Business Reviews
CVE-2026-23804
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-25000 - Wheel of Life Plugin
Missing Authorization vulnerability in Kraft Plugins Wheel of Life wheel-of-life allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wheel of Life: from n/a through
PLUGIN
Wheel of Life
CVE-2026-25000
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-24999 - Alma Plugin
Missing Authorization vulnerability in Alma Alma alma-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alma: from n/a through
PLUGIN
Alma
CVE-2026-24999
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-24375 - Ultimate Gift Cards For WooCommerce Plugin
Missing Authorization vulnerability in WP Swings Ultimate Gift Cards For WooCommerce woo-gift-cards-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Gift Cards For WooCommerce: from n/a through
PLUGIN
Ultimate Gift Cards For WooCommerce
CVE-2026-24375
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-23549 - WpEvently Plugin
Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through
PLUGIN
WpEvently
CVE-2026-23549
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-23542 - Grand Restaurant Plugin
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through
PLUGIN
Grand Restaurant
CVE-2026-23542
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-23544 - Valenti Plugin
Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through
PLUGIN
Valenti
CVE-2026-23544
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-23547 - CMSMasters Content Composer Plugin
Missing Authorization vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMSMasters Content Composer: from n/a through
PLUGIN
CMSMasters Content Composer
CVE-2026-23547
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-23545 - Aruba HiSpeed Cache Plugin
Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aruba HiSpeed Cache: from n/a through
PLUGIN
Aruba HiSpeed Cache
CVE-2026-23545
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-23548 - DirectoryPress Plugin
Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through
PLUGIN
DirectoryPress
CVE-2026-23548
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-23543 - Essential Addons for Elementor Plugin
Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through
PLUGIN
Essential Addons for Elementor
CVE-2026-23543
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-23541 - Mail Mint Plugin
Missing Authorization vulnerability in WPFunnels Mail Mint mail-mint allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mail Mint: from n/a through
PLUGIN
Mail Mint
CVE-2026-23541
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22333 - YITH WooCommerce Compare Theme
Deserialization of Untrusted Data vulnerability in YITHEMES YITH WooCommerce Compare yith-woocommerce-compare allows Object Injection.This issue affects YITH WooCommerce Compare: from n/a through
THEME
YITH WooCommerce Compare
CVE-2026-22333
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22422 - Everest Forms Plugin
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in wpeverest Everest Forms everest-forms allows Code Injection.This issue affects Everest Forms: from n/a through
PLUGIN
Everest Forms
CVE-2026-22422
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2502 - Xmlrpc Attacks Blocker Plugin
The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' HTTP header. This is due to the plugin trusting and logging attacker-controlled IP header data and rendering debug log entries without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page.
PLUGIN
Xmlrpc Attacks Blocker
CVE-2026-2502
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2284 - News Element Plugin
The News Element Elementor Blog Magazine plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.8. This is due to a missing capability check and nonce verification on the 'ne_clean_data' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to truncate 8 core WordPress database tables (posts, comments, terms, term_relationships, term_taxonomy, postmeta, commentmeta, termmeta) and delete the entire WordPress uploads directory, resulting in complete data loss.
PLUGIN
News Element
CVE-2026-2284
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2282 - Slidorion Plugin
The Slidorion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Slidorion
CVE-2026-2282
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-2504 - Dealia – Request a quote Plugin
The Dealia – Request a quote plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple AJAX handlers in all versions up to, and including, 1.0.7. The admin nonce (DEALIA_ADMIN_NONCE) is exposed to all users with edit_posts capability (Contributor+) via wp_localize_script() in PostsController.php, while the AJAX handlers in AdminSettingsController.php only verify the nonce without checking current_user_can('manage_options'). This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin configuration.
PLUGIN
Dealia – Request a quote
CVE-2026-2504
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1994 - s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Plugin
The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
PLUGIN
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
CVE-2026-1994
Risk Score