Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-08
CVE-2026-9701 - Eventer Plugin
The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-9700), this makes it possible for unauthenticated attackers to extract the plaintext reset key…
PLUGIN
Eventer
CVE-2026-9701
Risk Score
Threat Entry
Updated 2026-07-08
CVE-2026-14487 - Simple Coherent Form Plugin
The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The scf_get_id_upload endpoint freely issues a valid scf_upload_file_removal nonce to any unauthenticated visitor, and the removal endpoint's secondary hash check is forgeable offline because it relies on a…
PLUGIN
Simple Coherent Form
CVE-2026-14487
Risk Score
Threat Entry
Updated 2026-07-08
CVE-2026-14482 - Duoshuo Plugin
The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. The vulnerability exists due to a missing capability and nonce check on a directly web-accessible API endpoint, combined with a trivially forgeable HMAC-SHA1 signature keyed on an always-empty WordPress option, which allows the endpoint's `update_option` handler to pass attacker-controlled `option` and `value` parameters directly to WordPress's `update_option` function without any allowlist or sanitization. This makes it possible for unauthenticated attackers to update arbitrary WordPress options — such as setting `default_role` to `administrator`…
PLUGIN
Duoshuo
CVE-2026-14482
Risk Score
Threat Entry
Updated 2026-07-08
CVE-2026-14158 - Widget Logic Visual Plugin
The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequent use in an eval() call. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.
PLUGIN
Widget Logic Visual
CVE-2026-14158
Risk Score
Threat Entry
Updated 2026-07-08
CVE-2026-14244 - Jssor Slider by jssor.com Plugin
The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Jssor Slider by jssor.com
CVE-2026-14244
Risk Score
Threat Entry
Updated 2026-07-07
CVE-2026-6101 - Accelerated Mobile Pages Plugin
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, and permissions granted by an Administrator, to write arbitrary files to the server in a web-accessible location, potentially leading to remote code execution on hosts that execute PHP files in…
PLUGIN
Accelerated Mobile Pages
CVE-2026-6101
Risk Score
Threat Entry
Updated 2026-07-08
CVE-2026-14345 - WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell Plugin
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator…
PLUGIN
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
CVE-2026-14345
Risk Score
Threat Entry
Updated 2026-07-07
CVE-2026-12375 - Uncanny Automator Pro Plugin
The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator session on affected sites and beacons the site's secret keys and administrator details to attacker-controlled servers.
PLUGIN
Uncanny Automator Pro
CVE-2026-12375
Risk Score
Threat Entry
Updated 2026-07-07
CVE-2026-4375 - Doleads Integrator Plugin
The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users.
PLUGIN
Doleads Integrator
CVE-2026-4375
Risk Score
Threat Entry
Updated 2026-07-07
CVE-2026-12277 - Frontend File Manager Plugin
The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php) when guest upload mode is enabled. Deleting wp-config.php forces the site into its setup routine, which can be leveraged toward a full site takeover.
PLUGIN
Frontend File Manager Plugin
CVE-2026-12277
Risk Score
Threat Entry
Updated 2026-07-09
CVE-2026-10834 - Wp Travel Engine Plugin
The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.
PLUGIN
Wp Travel Engine
CVE-2026-10834
Risk Score
Threat Entry
Updated 2026-07-07
CVE-2026-11328 - Exclusive Addons For Elementor Plugin
The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Exclusive Addons For Elementor
CVE-2026-11328
Risk Score
Threat Entry
Updated 2026-07-07
CVE-2026-12154 - Fb Reviews Widget Plugin
The Reviews Widgets for Google, Yelp & TripAdvisor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_id' shortcode attribute of the [fbrev] shortcode in versions up to and including 2.7.3. This is due to insufficient input sanitization and output escaping in the Feed_Shortcode::fbrev() method, which passes the raw shortcode attribute through Feed_Old::get_feed() into the View::render() method, where it is echoed directly into the data-id HTML attribute without esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages…
PLUGIN
Fb Reviews Widget
CVE-2026-12154
Risk Score
Threat Entry
Updated 2026-07-06
CVE-2026-6382 - File Manager Pro Plugin
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
PLUGIN
File Manager Pro
CVE-2026-6382
Risk Score
Threat Entry
Updated 2026-07-06
CVE-2026-11962 - Before 1 Plugin
The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing authenticated users who have been granted file-manager access — which its premium add-on can extend to sub-administrator roles — to upload arbitrary PHP files and achieve remote code execution. This is an incomplete fix of CVE-2024-7985, which only added file-type validation to the upload operation.
PLUGIN
Before 1
CVE-2026-11962
Risk Score
Threat Entry
Updated 2026-07-06
CVE-2026-11855 - Simple Membership Plugin
The Simple Membership WordPress plugin before 4.7.5 does not verify the authenticity of Stripe webhook requests when no signing secret is configured, nor escape a value taken from them before outputting it in an administrator notice, allowing unauthenticated attackers to inject arbitrary web scripts that execute in the context of a logged-in administrator.
PLUGIN
Simple Membership
CVE-2026-11855
Risk Score
Threat Entry
Updated 2026-07-06
CVE-2026-12083 - Admin Site Enhancements Pro Plugin
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.
PLUGIN
Admin Site Enhancements Pro
CVE-2026-12083
Risk Score
Threat Entry
Updated 2026-07-06
CVE-2026-11766 - Ultimate Member Plugin
The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before outputting it on user profiles, allowing authenticated users with Subscriber-level access and above to store JavaScript that executes when any user, including an administrator, views the affected profile.
PLUGIN
Ultimate Member
CVE-2026-11766
Risk Score
Threat Entry
Updated 2026-07-06
CVE-2026-10830 - Before 1 Plugin
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site.
PLUGIN
Before 1
CVE-2026-10830
Risk Score
Threat Entry
Updated 2026-07-07
CVE-2026-59519 - FormLayer Plugin
Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issue affects FormLayer: from n/a through 1.0.6.
PLUGIN
FormLayer
CVE-2026-59519
Risk Score