Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-1371 - Elearning And Online Course Solution Plugin
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.
PLUGIN
Elearning And Online Course Solution
CVE-2026-1371
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1210 - Happy Addons For Elementor Plugin
The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_elementor_data' meta field in all versions up to, and including, 3.20.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Happy Addons For Elementor
CVE-2026-1210
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1447 - Mail Mint – Newsletters, Email Marketing, Automation, WooCommerce Emails, Post Notification, and more Plugin
The Mail Mint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19.2. This is due to missing nonce validation on the create_or_update_note function. This makes it possible for unauthenticated attackers to create or update contact notes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to missing sanitization and escaping this can lead to stored Cross-Site Scripting.
PLUGIN
Mail Mint – Newsletters, Email Marketing, Automation, WooCommerce Emails, Post Notification, and more
CVE-2026-1447
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1065 - Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Plugin
The Form Maker by 10Web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.15.35. This is due to the plugin's default file upload allowlist including SVG files combined with weak substring-based extension validation. This makes it possible for unauthenticated attackers to upload malicious SVG files containing JavaScript code that will execute when viewed by administrators or site visitors via file upload fields in forms granted they can submit forms.
PLUGIN
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
CVE-2026-1065
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-0617 - Calendar Booking Plugin For Appointments And Events
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer profile fields in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the customer's activity history.
PLUGIN
Calendar Booking Plugin For Appointments And Events
CVE-2026-0617
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1058 - Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Plugin
The Form Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via hidden field values in all versions up to, and including, 1.15.35. This is due to insufficient output escaping when displaying hidden field values in the admin submissions list. The plugin uses html_entity_decode() on user-supplied hidden field values without subsequent escaping before output, which converts HTML entity-encoded payloads back into executable JavaScript. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin submissions view that will execute whenever an administrator accesses the submissions…
PLUGIN
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
CVE-2026-1058
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-0950 - Spectra Gutenberg Blocks – Website Builder for the Block Editor Plugin
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.19.17. This is due to the plugin failing to check `post_password_required()` before rendering post excerpts in the `render_excerpt()` function and the `uagb_get_excerpt()` helper function. This makes it possible for unauthenticated attackers to read excerpts of password-protected posts by simply viewing any page that contains a Spectra Post Grid, Post Masonry, Post Carousel, or Post Timeline block.
PLUGIN
Spectra Gutenberg Blocks – Website Builder for the Block Editor
CVE-2026-0950
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-14274 - Unlimited Elements For Elementor Plugin
The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Border Hero widget's Button Link field in versions up to 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied URLs. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Unlimited Elements For Elementor
CVE-2025-14274
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-0909 - WP ULike – Engagement Analytics & Interactive Buttons to Understand Your Audience Plugin
The WP ULike plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.3.1. This is due to the `wp_ulike_delete_history_api` AJAX action not verifying that the log entry being deleted belongs to the current user. This makes it possible for authenticated attackers, with Subscriber-level access and above (granted the 'stats' capability is assigned to their role), to delete arbitrary log entries belonging to other users via the 'id' parameter.
PLUGIN
WP ULike – Engagement Analytics & Interactive Buttons to Understand Your Audience
CVE-2026-0909
Risk Score
Threat Entry
Updated 2026-02-23
CVE-2026-24007 - Git Plugin
Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items (creating artifact links from the release). This vulnerability is fixed in Tuleap Community Edition 17.0.99.1768924735 and Tuleap Enterprise Edition 17.2-5, 17.1-6, and 17.0-9.
PLUGIN
Git
CVE-2026-24007
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-0658 - Five Star Restaurant Reservations Plugin
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting bookings via CSRF attacks.
PLUGIN
Five Star Restaurant Reservations
CVE-2026-0658
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-15396 - Library Viewer Plugin
The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
PLUGIN
Library Viewer
CVE-2025-15396
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-15030 - User Profile Builder Plugin
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
PLUGIN
User Profile Builder
CVE-2025-15030
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1165 - Ays Popup Box Plugin
The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publish_unpublish_popupbox' function that verifies a self-created nonce rather than one submitted in the request. This makes it possible for unauthenticated attackers to change the publish status of popups via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
PLUGIN
Ays Popup Box
CVE-2026-1165
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-14554 - Sell Btc By Hayyatapps Plugin
The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderform_data' AJAX action in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in order records that will execute whenever an administrator accesses the Orders page in the admin dashboard. The vulnerability was partially patched in version 1.5.
PLUGIN
Sell Btc By Hayyatapps
CVE-2025-14554
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1251 - Customer Support Ticket System Plugin
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.4 via the 'add_reply' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to steal file attachments uploaded by other users by specifying arbitrary attachment IDs in the 'description_attachments' parameter, re-associating those files to their own tickets and removing access from the original owners.
PLUGIN
Customer Support Ticket System
CVE-2026-1251
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-0683 - Customer Support Ticket System Plugin
The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all versions up to, and including, 3.4.4. This is due to insufficient escaping on the user-supplied operand value when using the equals operator and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above (customers), to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Customer Support Ticket System
CVE-2026-0683
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1431 - Booking Calendar Plugin
The Booking Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wpbc_ajax_WPBC_FLEXTIMELINE_NAV() function in all versions up to, and including, 10.14.13. This makes it possible for unauthenticated attackers to retrieve booking information including customer names, phones and emails.
PLUGIN
Booking Calendar
CVE-2026-1431
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-15525 - Ajax Load More Plugin
The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization on the parse_custom_args() function in all versions up to, and including, 7.8.1. This makes it possible for unauthenticated attackers to expose the titles and excerpts of private, draft, pending, scheduled, and trashed posts.
PLUGIN
Ajax Load More
CVE-2025-15525
Risk Score
Threat Entry
Updated 2026-02-03
CVE-2025-15510 - Nex Forms Express Wp Form Builder Plugin
The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms class constructor in all versions up to, and including, 9.1.8. This makes it possible for unauthenticated attackers to export form configurations, that may include sensitive data, such as email addresses, PayPal API credentials, and third-party integration keys by enumerating the nex_forms_Id parameter.
PLUGIN
Nex Forms Express Wp Form Builder
CVE-2025-15510
Risk Score