Threat Entry Updated 2026-06-17

CVE-2026-24609 - Laurent Plugin

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows PHP Local File Inclusion.This issue affects Laurent: from n/a through

PLUGIN Laurent

CVE-2026-24609

HIGH CVSS 7.5 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24608 - Laurent Core Plugin

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent Core laurent-core allows PHP Local File Inclusion.This issue affects Laurent Core: from n/a through

PLUGIN Laurent Core

CVE-2026-24608

HIGH CVSS 7.5 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24612 - Orchid Store Plugin

Missing Authorization vulnerability in themebeez Orchid Store orchid-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Orchid Store: from n/a through

PLUGIN Orchid Store

CVE-2026-24612

MEDIUM CVSS 5.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24607 - Travel Monster Plugin

Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Monster: from n/a through

PLUGIN Travel Monster

CVE-2026-24607

MEDIUM CVSS 5.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24606 - WooCommerce Plugin

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through

PLUGIN WooCommerce

CVE-2026-24606

MEDIUM CVSS 5.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24604 - Simple GDPR Cookie Compliance Plugin

Missing Authorization vulnerability in themebeez Simple GDPR Cookie Compliance simple-gdpr-cookie-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple GDPR Cookie Compliance: from n/a through

PLUGIN Simple GDPR Cookie Compliance

CVE-2026-24604

MEDIUM CVSS 5.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24605 - X Addons for Elementor Plugin

Missing Authorization vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects X Addons for Elementor: from n/a through

PLUGIN X Addons for Elementor

CVE-2026-24605

MEDIUM CVSS 4.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24601 - Penci Pay Writer Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Pay Writer penci-pay-writer allows Stored XSS.This issue affects Penci Pay Writer: from n/a through

PLUGIN Penci Pay Writer

CVE-2026-24601

MEDIUM CVSS 6.5 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24600 - Penci Review Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Review penci-review allows Stored XSS.This issue affects Penci Review: from n/a through

PLUGIN Penci Review

CVE-2026-24600

MEDIUM CVSS 6.5 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24603 - Universal Google Adsense and Ads manager Plugin

Missing Authorization vulnerability in themebeez Universal Google Adsense and Ads manager universal-google-adsense-and-ads-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Universal Google Adsense and Ads manager: from n/a through

PLUGIN Universal Google Adsense and Ads manager

CVE-2026-24603

MEDIUM CVSS 5.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24599 - NextMove Lite Plugin

Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through

PLUGIN NextMove Lite

CVE-2026-24599

MEDIUM CVSS 5.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24591 - Turn Yoast SEO FAQ Block to Accordion Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yasir129 Turn Yoast SEO FAQ Block to Accordion faq-schema-block-to-accordion allows Stored XSS.This issue affects Turn Yoast SEO FAQ Block to Accordion: from n/a through

PLUGIN Turn Yoast SEO FAQ Block to Accordion

CVE-2026-24591

MEDIUM CVSS 6.5 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24594 - Livemesh Addons for WPBakery Page Builder Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for WPBakery Page Builder addons-for-visual-composer allows Stored XSS.This issue affects Livemesh Addons for WPBakery Page Builder: from n/a through

PLUGIN Livemesh Addons for WPBakery Page Builder

CVE-2026-24594

MEDIUM CVSS 5.9 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24595 - Zoho CRM Lead Magnet Plugin

Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho CRM Lead Magnet: from n/a through

PLUGIN Zoho CRM Lead Magnet

CVE-2026-24595

MEDIUM CVSS 5.4 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24593 - AWP Classifieds Plugin

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Embedded Sensitive Data.This issue affects AWP Classifieds: from n/a through

PLUGIN AWP Classifieds

CVE-2026-24593

MEDIUM CVSS 5.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24596 - Related Posts Thumbnails Plugin for WordPress

Cross-Site Request Forgery (CSRF) vulnerability in marynixie Related Posts Thumbnails Plugin for WordPress related-posts-thumbnails allows Cross Site Request Forgery.This issue affects Related Posts Thumbnails Plugin for WordPress: from n/a through

PLUGIN Related Posts Thumbnails Plugin for WordPress

CVE-2026-24596

MEDIUM CVSS 4.7 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24598 - Multilanguage by BestWebSoft Plugin

Missing Authorization vulnerability in bestwebsoft Multilanguage by BestWebSoft multilanguage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multilanguage by BestWebSoft: from n/a through

PLUGIN Multilanguage by BestWebSoft

CVE-2026-24598

MEDIUM CVSS 4.3 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24585 - WooCommerce Plugin

Missing Authorization vulnerability in Hyyan Abo Fakher Hyyan WooCommerce Polylang Integration woo-poly-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hyyan WooCommerce Polylang Integration: from n/a through

PLUGIN WooCommerce

CVE-2026-24585

MEDIUM CVSS 6.5 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24584 - Tutor LMS BunnyNet Integration Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS BunnyNet Integration tutor-lms-bunnynet-integration allows DOM-Based XSS.This issue affects Tutor LMS BunnyNet Integration: from n/a through

PLUGIN Tutor LMS BunnyNet Integration

CVE-2026-24584

MEDIUM CVSS 5.9 2026-01-23

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24587 - AJAX Hits Counter + Popular Posts Widget Plugin

Missing Authorization vulnerability in kutsy AJAX Hits Counter + Popular Posts Widget ajax-hits-counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Hits Counter + Popular Posts Widget: from n/a through

PLUGIN AJAX Hits Counter + Popular Posts Widget

CVE-2026-24587

MEDIUM CVSS 5.4 2026-01-23

Risk Score

Open Full Technical Breakdown