Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
Tournamatch - Security Vulnerability (CVE-2026-121379)
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.
PLUGIN
Tournamatch
CVE-2026-121379
Risk Score
Threat Entry
Updated 2026-11-10
Fiber Admin - Security Vulnerability (CVE-2026-121491)
The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race against an administrator saving its settings.
PLUGIN
Fiber Admin
CVE-2026-121491
Risk Score
Threat Entry
Updated 2026-11-10
iLeads SMS Gateway by Exsile - Security Vulnerability (CVE-2026-121866)
The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check capabilities or nonces in several AJAX actions that update a site option chosen by the request, allowing any authenticated user, such as a subscriber, to change arbitrary WordPress options and escalate to administrator, for example by enabling registration with administrator as the default role.
PLUGIN
iLeads SMS Gateway by Exsile
CVE-2026-121866
Risk Score
Threat Entry
Updated 2026-11-10
Magic Link - Security Vulnerability (CVE-2026-121848)
The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.
PLUGIN
Magic Link
CVE-2026-121848
Risk Score
Threat Entry
Updated 2026-11-10
Add From Server Lite - Security Vulnerability (CVE-2026-121796)
The Add From Server Lite WordPress plugin before 6.0.0 does not restrict SVG uploads to users allowed to post unfiltered HTML, allowing users with the Author role and above to upload SVG files containing JavaScript and perform Stored XSS attacks.
PLUGIN
Add From Server Lite
CVE-2026-121796
Risk Score
Threat Entry
Updated 2026-11-10
Event Tickets with Ticket Scanner - Security Vulnerability (CVE-2026-121858)
The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks.
PLUGIN
Event Tickets with Ticket Scanner
CVE-2026-121858
Risk Score
Threat Entry
Updated 2026-11-10
Fiber Admin - Security Vulnerability (CVE-2026-121492)
The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering is enabled.
PLUGIN
Fiber Admin
CVE-2026-121492
Risk Score
Threat Entry
Updated 2026-11-10
Tournamatch - Security Vulnerability (CVE-2026-121380)
The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
PLUGIN
Tournamatch
CVE-2026-121380
Risk Score
Threat Entry
Updated 2026-11-10
Event Tickets with Ticket Scanner - Security Vulnerability (CVE-2026-121857)
The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders.
PLUGIN
Event Tickets with Ticket Scanner
CVE-2026-121857
Risk Score
Threat Entry
Updated 2026-11-10
Live Composer - Security Vulnerability (CVE-2026-119073)
The Live Composer WordPress plugin before 2.1.23 does not escape a pagination setting supplied through its post-listing module shortcodes before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Live Composer
CVE-2026-119073
Risk Score
Threat Entry
Updated 2026-11-10
Directorist - Security Vulnerability (CVE-2026-118532)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files.
PLUGIN
Directorist
CVE-2026-118532
Risk Score
Threat Entry
Updated 2026-11-10
Directorist - Security Vulnerability (CVE-2026-118530)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email.
PLUGIN
Directorist
CVE-2026-118530
Risk Score
Threat Entry
Updated 2026-11-10
Directorist - Security Vulnerability (CVE-2026-118534)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt records against other users' orders.
PLUGIN
Directorist
CVE-2026-118534
Risk Score
Threat Entry
Updated 2026-11-10
Directorist - Security Vulnerability (CVE-2026-118533)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.
PLUGIN
Directorist
CVE-2026-118533
Risk Score
Threat Entry
Updated 2026-11-10
Directorist - Security Vulnerability (CVE-2026-118528)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.
PLUGIN
Directorist
CVE-2026-118528
Risk Score
Threat Entry
Updated 2026-11-10
WP Google Review Slider - Security Vulnerability (CVE-2026-117588)
The WP Google Review Slider WordPress plugin before 18.11 does not perform nonce validation when updating its active Google Places configuration, allowing attackers to alter or destroy that configuration via a forged request, provided they can trick a site administrator into following a crafted link.
PLUGIN
WP Google Review Slider
CVE-2026-117588
Risk Score
Threat Entry
Updated 2026-11-10
Directorist - Security Vulnerability (CVE-2026-118529)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.
PLUGIN
Directorist
CVE-2026-118529
Risk Score
Threat Entry
Updated 2026-11-10
FV Flowplayer Video Player - Security Vulnerability (CVE-2026-117525)
The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any visitor, including an administrator, who plays the commented video, when the non-default comment-shortcode-parsing setting is enabled.
PLUGIN
FV Flowplayer Video Player
CVE-2026-117525
Risk Score
Threat Entry
Updated 2026-11-07
Soledad - Security Vulnerability (CVE-2026-93902)
The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author//, which is accessible to unauthenticated visitors regardless of…
THEME
Soledad
CVE-2026-93902
Risk Score
Threat Entry
Updated 2026-11-07
Stackable Ultimate Gutenberg Blocks - Security Vulnerability (CVE-2026-9601)
The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'update_block_style' endpoint in all versions up to, and including, 3.19.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Stackable Ultimate Gutenberg Blocks
CVE-2026-9601
Risk Score