Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-02-24
CVE-2026-24054 - Snapshots Plugin
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host…
PLUGIN
Snapshots
CVE-2026-24054
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14975 - Custom Login Page Customizer Plugin
The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
PLUGIN
Custom Login Page Customizer
CVE-2025-14975
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1060 - WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer Plugin
The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission_callback set to __return_true, allowing unauthenticated attackers to retrieve the complete list of available addons, their installation status, version numbers, and download URLs.
PLUGIN
WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer
CVE-2026-1060
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14795 - Stop Spammer Registrations Plugin
The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing nonce validation in the ss_addtoallowlist class. This makes it possible for unauthenticated attackers to add arbitrary email addresses to the spam allowlist via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The vulnerability was partially patched in version 2026.1.
PLUGIN
Stop Spammer Registrations
CVE-2025-14795
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1056 - Snow Monkey Forms Plugin
The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'generate_user_dirpath' function in all versions up to, and including, 12.0.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Snow Monkey Forms
CVE-2026-1056
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14865 - Content Protector Plugin
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortcode in all versions up to, and including, 4.2.24. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 4.2.21.
PLUGIN
Content Protector
CVE-2025-14865
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1391 - Vzaar Media Management Plugin
The Vzaar Media Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on the $_SERVER['PHP_SELF'] variable. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Vzaar Media Management
CVE-2026-1391
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1399 - WP Google Ad Manager Plugin
The WP Google Ad Manager Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
WP Google Ad Manager Plugin
CVE-2026-1399
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1398 - Change Wp Url Plugin
The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Change Wp Url
CVE-2026-1398
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-0844 - Simple User Registration Plugin
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update.
PLUGIN
Simple User Registration
CVE-2026-0844
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1280 - Frontend File Manager Plugin
The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated attackers to share arbitrary uploaded files via email by supplying a file ID. Since file IDs are sequential integers, attackers can enumerate all uploaded files on the site and exfiltrate sensitive data that was intended to be restricted to administrators only.
PLUGIN
Frontend File Manager Plugin
CVE-2026-1280
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1380 - Bitcoin Donate Button Plugin
The Bitcoin Donate Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the settings page. This makes it possible for unauthenticated attackers to modify the plugin's settings, including donation addresses and display configurations, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Bitcoin Donate Button
CVE-2026-1380
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1377 - Imwptip Plugin
The imwptip plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Imwptip
CVE-2026-1377
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-15511 - Rupantorpay Plugin
The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to modify WooCommerce order statuses by sending crafted requests to the WooCommerce API endpoint.
PLUGIN
Rupantorpay
CVE-2025-15511
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14616 - Recooty Plugin
The Recooty – Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing nonce validation on the recooty_save_maybe() function. This makes it possible for unauthenticated attackers to update the recooty_key option and inject malicious content into iframe src attributes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Recooty
CVE-2025-14616
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14386 - Integrated Ai Optimization Plugin
The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the 'generate_sso_url' and 'validate_sso_token' functions in versions 2.4.4 to 2.5.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract the 'nonce_token' authentication value to log in to the first Administrator's account.
PLUGIN
Integrated Ai Optimization
CVE-2025-14386
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14283 - Blockart Blocks Plugin
The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BlockArt Counter in all versions up to, and including, 2.2.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Blockart Blocks
CVE-2025-14283
Risk Score
Threat Entry
Updated 2026-01-29
CVE-2025-14063 - Seo Links Interlinking Plugin
The SEO Links Interlinking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_error' parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Seo Links Interlinking
CVE-2025-14063
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1400 - AI Engine – The Chatbot and AI Framework for WordPress Plugin
The AI Engine – The Chatbot and AI Framework for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `rest_helpers_update_media_metadata` function in all versions up to, and including, 3.3.2. This makes it possible for authenticated attackers, with Editor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The attacker can upload a benign image file, then use the `update_media_metadata` endpoint to rename it to a PHP file, creating an executable PHP…
PLUGIN
AI Engine – The Chatbot and AI Framework for WordPress
CVE-2026-1400
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-1381 - Order Minimum Amount For Woocommerce Plugin
The Order Minimum/Maximum Amount Limits for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Shop Manager-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Order Minimum Amount For Woocommerce
CVE-2026-1381
Risk Score