Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-09
Mycred - Security Vulnerability (CVE-2026-123471)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.
PLUGIN
Mycred
CVE-2026-123471
Risk Score
Threat Entry
Updated 2026-11-07
PublishPress Revisions - Security Vulnerability (CVE-2026-120851)
Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0.
PLUGIN
PublishPress Revisions
CVE-2026-120851
Risk Score
Threat Entry
Updated 2026-11-07
Royal Elementor Addons - Security Vulnerability (CVE-2026-119519)
Missing Authorization vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1068.
PLUGIN
Royal Elementor Addons
CVE-2026-119519
Risk Score
Threat Entry
Updated 2026-11-06
Upsell Order Bump Offer For Woocommerce - Security Vulnerability (CVE-2026-115431)
Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6.
PLUGIN
Upsell Order Bump Offer For Woocommerce
CVE-2026-115431
Risk Score
Threat Entry
Updated 2026-11-06
Forminator - Security Vulnerability (CVE-2026-115952)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.
PLUGIN
Forminator
CVE-2026-115952
Risk Score
Threat Entry
Updated 2026-11-06
Elementor - Security Vulnerability (CVE-2026-109884)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Reflected XSS.This issue affects Elementor Website Builder: from n/a through 4.3.5.
PLUGIN
Elementor
CVE-2026-109884
Risk Score
Threat Entry
Updated 2026-11-06
Elementor - Security Vulnerability (CVE-2026-109883)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5.
PLUGIN
Elementor
CVE-2026-109883
Risk Score
Threat Entry
Updated 2026-11-06
Live 2d - Security Vulnerability (CVE-2026-92895)
The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension whitelist and MIME type validation in download_one_file() when writing files derived from attacker-controlled manifest entries to the web-served plugin directory. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible when the plugin's apiType setting is configured as custom-local (self-hosted model mode), a non-default option that requires a paid license…
PLUGIN
Live 2d
CVE-2026-92895
Risk Score
Threat Entry
Updated 2026-11-06
Everest Forms - Security Vulnerability (CVE-2026-89101)
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with custom-level access and above, to view, read, and permanently delete forms and entries belonging to any other user — including personally identifiable information submitted through public contact and lead forms — regardless of form ownership.
PLUGIN
Everest Forms
CVE-2026-89101
Risk Score
Threat Entry
Updated 2026-11-06
Feedzy Rss Feeds - Security Vulnerability (CVE-2026-120035)
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed )' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL,…
PLUGIN
Feedzy Rss Feeds
CVE-2026-120035
Risk Score
Threat Entry
Updated 2026-11-06
Smart Cookie Kit - Security Vulnerability (CVE-2026-119178)
The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is specifically crafted to survive wp_kses on save by storing hostile characters inside allowed HTML elements, with the attribute-breaking double-quote smuggled inside a permitted <code> body and reconstructed into a <abbr…
PLUGIN
Smart Cookie Kit
CVE-2026-119178
Risk Score
Threat Entry
Updated 2026-11-06
Aaa Option Optimizer - Security Vulnerability (CVE-2026-119211)
The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_page' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's Option Tracking setting to be configured to 'Legacy' mode, and succeeds despite WordPress ultimately returning HTTP 403 to the low-privileged caller because the vulnerable…
PLUGIN
Aaa Option Optimizer
CVE-2026-119211
Risk Score
Threat Entry
Updated 2026-11-06
Advanced Members - Security Vulnerability (CVE-2026-116624)
The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the `acf[_amem_local_user_password]` parameter of the `[advanced-members-account-password]` shortcode form submission. This is due to a PHP operator-precedence bug in the `pre_update_value` function of `acf/fields/class-user-password.php` that assigns boolean `true` instead of the resolved user ID to `$user_id`, causing the `_can_edit()` authorization check to pass for any logged-in user via PHP loose equality, and causing `wp_update_user()` to cast `'ID' => true` to integer `1` — unconditionally targeting the primary administrator account.…
PLUGIN
Advanced Members
CVE-2026-116624
Risk Score
Threat Entry
Updated 2026-11-06
Customer Area - Security Vulnerability (CVE-2026-116551)
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Customer Area
CVE-2026-116551
Risk Score
Threat Entry
Updated 2026-11-06
All In One Video Gallery - Security Vulnerability (CVE-2026-116545)
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site's Player Library option to be configured as Plyr/Vidstack (aiovg_player_settings[player]='vidstack') rather…
PLUGIN
All In One Video Gallery
CVE-2026-116545
Risk Score
Threat Entry
Updated 2026-11-06
Buddyforms - Security Vulnerability (CVE-2026-107622)
The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the `bf_post_type` parameter. This is due to the public frontend submission handler `buddyforms_form_response_no_ajax()` authorizing logged-out submissions based solely on the target form's `public_submit` flag while independently trusting the attacker-supplied `$_POST['bf_post_type']` to determine the post type of the newly created object — a cross-check introduced in 2.10.2 applies only to existing posts (`post_id != 0`) and is completely bypassed for new-object creation — combined with the `save_post`…
PLUGIN
Buddyforms
CVE-2026-107622
Risk Score
Threat Entry
Updated 2026-11-06
Elex Helpdesk Customer Support Ticket System - Security Vulnerability (CVE-2026-114630)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv…
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2026-114630
Risk Score
Threat Entry
Updated 2026-11-06
Buddyforms - Security Vulnerability (CVE-2026-107658)
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that at least one BuddyForms form with public submissions enabled exists on the site (so that the required nonce can be harvested from the public form page) and that the active…
PLUGIN
Buddyforms
CVE-2026-107658
Risk Score
Threat Entry
Updated 2026-11-06
Pubjet | پابجت - Security Vulnerability (CVE-2026-103479)
The Pubjet | پابجت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the `checkToken()` AJAX handler — registered under `wp_ajax_pubjet-check-token` — performing no capability check and no nonce verification before unconditionally writing the attacker-supplied `token` GET parameter directly into the site-wide `pubjet_settings` option via `pubjet_update_setting()`, prior to any remote validation. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's stored REST API credential with an attacker-chosen value, immediately elevating their effective…
PLUGIN
Pubjet | پابجت
CVE-2026-103479
Risk Score
Threat Entry
Updated 2026-11-06
Contactsheets Lite - Security Vulnerability (CVE-2026-104010)
The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field (e.g., your-message)' parameter parameter. This is due to insufficient sanitization of CF7 submission field values before database storage and the absence of an allowed_classes restriction on maybe_unserialize() during admin retrieval. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation of the remote code execution gadget chain…
PLUGIN
Contactsheets Lite
CVE-2026-104010
Risk Score