Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-11
Simple Membership - Security Vulnerability (CVE-2026-88785)
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.
PLUGIN
Simple Membership
CVE-2026-88785
Risk Score
Threat Entry
Updated 2026-10-11
Insurify - Security Vulnerability (CVE-2026-86717)
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.
PLUGIN
Insurify
CVE-2026-86717
Risk Score
Threat Entry
Updated 2026-10-11
Quick quotes - Security Vulnerability (CVE-2026-86706)
The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbitrary site settings and to make the site unavailable.
PLUGIN
Quick quotes
CVE-2026-86706
Risk Score
Threat Entry
Updated 2026-10-11
erwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify - Security Vulnerability (CVE-2026-85121)
The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify WordPress plugin through 1.0.
PLUGIN
erwrite arbitrary WordPress options with request data, which can take the site offline and deactivate all of its Insurify
CVE-2026-85121
Risk Score
Threat Entry
Updated 2026-10-11
BuddyPress Instant Chat - Security Vulnerability (CVE-2026-87764)
The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute in the session of any member who later views that conversation.
PLUGIN
BuddyPress Instant Chat
CVE-2026-87764
Risk Score
Threat Entry
Updated 2026-10-11
Adwised Web Push Notification - Security Vulnerability (CVE-2026-87762)
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where the secret key has never been set, allowing unauthenticated users to store arbitrary JavaScript that is executed in the browser of every site visitor.
PLUGIN
Adwised Web Push Notification
CVE-2026-87762
Risk Score
Threat Entry
Updated 2026-10-11
Web Vitals Tracking - Security Vulnerability (CVE-2026-87760)
The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administrative page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators.
PLUGIN
Web Vitals Tracking
CVE-2026-87760
Risk Score
Threat Entry
Updated 2026-10-11
HootBoard - Security Vulnerability (CVE-2026-86798)
The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.
PLUGIN
HootBoard
CVE-2026-86798
Risk Score
Threat Entry
Updated 2026-10-11
Adwised Web Push Notification - Security Vulnerability (CVE-2026-87761)
The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwrite its site-wide configuration, and does not escape those configuration values before printing them inside an inline script block on every front-end page, allowing any authenticated user, such as a subscriber, to perform Stored Cross-Site Scripting attacks against every visitor, including administrators.
PLUGIN
Adwised Web Push Notification
CVE-2026-87761
Risk Score
Threat Entry
Updated 2026-10-11
Crowdfundly - Security Vulnerability (CVE-2026-85126)
The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privileged roles to grant themselves the administrator role or arbitrary capabilities, leading to a full site takeover.
PLUGIN
Crowdfundly
CVE-2026-85126
Risk Score
Threat Entry
Updated 2026-10-11
AI Content Generator Marketing - Security Vulnerability (CVE-2026-85118)
The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options, which can be used to gain administrator access to the site.
PLUGIN
AI Content Generator Marketing
CVE-2026-85118
Risk Score
Threat Entry
Updated 2026-10-11
Freeton WP - Security Vulnerability (CVE-2026-84737)
The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.
PLUGIN
Freeton WP
CVE-2026-84737
Risk Score
Threat Entry
Updated 2026-10-11
Mindstien Quick Login - Security Vulnerability (CVE-2026-84734)
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
PLUGIN
Mindstien Quick Login
CVE-2026-84734
Risk Score
Threat Entry
Updated 2026-10-11
click5 CRM add-on to Contact Form 7 - Security Vulnerability (CVE-2026-84254)
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
PLUGIN
click5 CRM add-on to Contact Form 7
CVE-2026-84254
Risk Score
Threat Entry
Updated 2026-10-11
click5 CRM add-on to Gravity Forms - Security Vulnerability (CVE-2026-84253)
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
PLUGIN
click5 CRM add-on to Gravity Forms
CVE-2026-84253
Risk Score
Threat Entry
Updated 2026-10-11
click5 CRM add-on to Contact Form 7 - Security Vulnerability (CVE-2026-84261)
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
PLUGIN
click5 CRM add-on to Contact Form 7
CVE-2026-84261
Risk Score
Threat Entry
Updated 2026-10-11
click5 CRM add-on to Gravity Forms - Security Vulnerability (CVE-2026-84260)
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
PLUGIN
click5 CRM add-on to Gravity Forms
CVE-2026-84260
Risk Score
Threat Entry
Updated 2026-10-11
click5 CRM add-on to WPForms - Security Vulnerability (CVE-2026-84259)
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
PLUGIN
click5 CRM add-on to WPForms
CVE-2026-84259
Risk Score
Threat Entry
Updated 2026-10-11
click5 CRM add-on to Ninja Forms - Security Vulnerability (CVE-2026-84258)
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
PLUGIN
click5 CRM add-on to Ninja Forms
CVE-2026-84258
Risk Score
Threat Entry
Updated 2026-10-11
click5 CRM add-on to WPForms - Security Vulnerability (CVE-2026-84252)
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.
PLUGIN
click5 CRM add-on to WPForms
CVE-2026-84252
Risk Score