Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-08
Wpjam Basic - Security Vulnerability (CVE-2026-103900)
The WPJAM Basic plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 7.1 This is due to the WPJAM_User_Signup::signup() function unpacking attacker-supplied `data[args]` from the AJAX POST body and merging it via PHP array union into the payload passed to WPJAM_User::create(), whose internal whitelist (wpjam_pick) explicitly preserves the `role` key before it is handed to wp_insert_user(). The endpoint is registered as wp_ajax_nopriv_{provider}-signup with a nonce that is emitted on the public login page. This makes it possible for unauthenticated attackers to elevate their privileges to…
PLUGIN
Wpjam Basic
CVE-2026-103900
Risk Score
Threat Entry
Updated 2026-11-07
Superb Blocks - Security Vulnerability (CVE-2026-66669)
Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4.
PLUGIN
Superb Blocks
CVE-2026-66669
Risk Score
Threat Entry
Updated 2026-11-07
Learnpress - Security Vulnerability (CVE-2026-52713)
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.12.
PLUGIN
Learnpress
CVE-2026-52713
Risk Score
Threat Entry
Updated 2026-11-07
Mycred - Security Vulnerability (CVE-2026-124274)
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
PLUGIN
Mycred
CVE-2026-124274
Risk Score
Threat Entry
Updated 2026-11-09
Wp User Avatar - Security Vulnerability (CVE-2026-39733)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7.
PLUGIN
Wp User Avatar
CVE-2026-39733
Risk Score
Threat Entry
Updated 2026-11-07
Wp Social - Security Vulnerability (CVE-2026-122675)
Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3.
PLUGIN
Wp Social
CVE-2026-122675
Risk Score
Threat Entry
Updated 2026-11-07
Fluent Booking - Security Vulnerability (CVE-2026-121781)
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0.
PLUGIN
Fluent Booking
CVE-2026-121781
Risk Score
Threat Entry
Updated 2026-11-07
Yith Woocommerce Subscription - Security Vulnerability (CVE-2026-121779)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a through 4.22.0.
PLUGIN
Yith Woocommerce Subscription
CVE-2026-121779
Risk Score
Threat Entry
Updated 2026-11-07
WP-Lister Lite for Amazon - Security Vulnerability (CVE-2026-121778)
Missing Authorization vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for Amazon: from n/a through 2.9.2.
PLUGIN
WP-Lister Lite for Amazon
CVE-2026-121778
Risk Score
Threat Entry
Updated 2026-11-07
Cf7 Post Fields - Security Vulnerability (CVE-2026-121768)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markus Wiesenhofer Contact Form 7 – Post Fields cf7-post-fields allows Stored XSS.This issue affects Contact Form 7 – Post Fields: from n/a through 2.6.0.
PLUGIN
Cf7 Post Fields
CVE-2026-121768
Risk Score
Threat Entry
Updated 2026-11-07
WCFM Marketplace - Security Vulnerability (CVE-2026-120848)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Stored XSS.This issue affects WCFM Marketplace: from n/a through 3.8.3.
PLUGIN
WCFM Marketplace
CVE-2026-120848
Risk Score
Threat Entry
Updated 2026-11-07
MC Woocommerce Wishlist - Security Vulnerability (CVE-2026-119510)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saeed MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Stored XSS.This issue affects MC Woocommerce Wishlist: from n/a through 2.0.3.
PLUGIN
MC Woocommerce Wishlist
CVE-2026-119510
Risk Score
Threat Entry
Updated 2026-11-09
Wedocs - Security Vulnerability (CVE-2026-121767)
Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weDocs: from n/a through 2.6.1.
PLUGIN
Wedocs
CVE-2026-121767
Risk Score
Threat Entry
Updated 2026-11-10
Vod Infomaniak - Security Vulnerability (CVE-2026-121761)
Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VOD Infomaniak: from n/a through 1.5.15.
PLUGIN
Vod Infomaniak
CVE-2026-121761
Risk Score
Threat Entry
Updated 2026-11-10
WCFM Marketplace - Security Vulnerability (CVE-2026-120849)
Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.3.
PLUGIN
WCFM Marketplace
CVE-2026-120849
Risk Score
Threat Entry
Updated 2026-11-07
Wp Recipe Maker - Security Vulnerability (CVE-2026-119489)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures WP Recipe Maker wp-recipe-maker allows Stored XSS.This issue affects WP Recipe Maker: from n/a through 10.9.1.
PLUGIN
Wp Recipe Maker
CVE-2026-119489
Risk Score
Threat Entry
Updated 2026-11-07
Anywhere Elementor - Security Vulnerability (CVE-2026-119467)
Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
PLUGIN
Anywhere Elementor
CVE-2026-119467
Risk Score
Threat Entry
Updated 2026-11-08
Advanced Form Integration - Security Vulnerability (CVE-2026-104738)
The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on…
PLUGIN
Advanced Form Integration
CVE-2026-104738
Risk Score
Threat Entry
Updated 2026-11-08
Qa Heatmap Analytics - Security Vulnerability (CVE-2026-87112)
The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling unserialize() without an allowed_classes restriction, combined with serialize_escape() failing to sanitize path traversal sequences in the raw_name parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. The Guzzle FileCookieJar gadget present in the plugin's bundled Composer dependencies can be leveraged to perform an Arbitrary File Write, writing attacker-controlled…
PLUGIN
Qa Heatmap Analytics
CVE-2026-87112
Risk Score
Threat Entry
Updated 2026-11-08
Woo Paystack - Security Vulnerability (CVE-2026-93370)
The Paystack WooCommerce Payment Gateway plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.5 via the 'key' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including billing name, email address, phone number, billing address, shipping address, and purchased product list — embedded into page HTML via wp_localize_script by enumerating sequential order IDs. This is only exploitable when the merchant has enabled the optional custom metadata feature in the Paystack gateway settings.
PLUGIN
Woo Paystack
CVE-2026-93370
Risk Score