Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-01-09
CVE-2025-9294 - Quiz Master Next Plugin
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results.
PLUGIN
Quiz Master Next
CVE-2025-9294
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-5919 - Timetics Plugin
The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and register_routes functions in all versions up to, and including, 1.0.36. This makes it possible for unauthenticated attackers to view and modify booking details.
PLUGIN
Timetics
CVE-2025-5919
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-13964 - Wordpress Lms Plugin
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp_ajax function in all versions up to, and including, 4.3.2. This makes it possible for unauthenticated attackers to modify course contents by adding/removing/updating/re-ordering sections or modifying section items.
PLUGIN
Wordpress Lms
CVE-2025-13964
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-13766 - For Online Courses And Education Plugin
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability checks on multiple REST API endpoints in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload or delete arbitrary media files, delete or modify posts, and create/manage course templates
PLUGIN
For Online Courses And Education
CVE-2025-13766
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-12067 - Table Field Add On For Acf And Scf Plugin
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and including, 1.3.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Table Field Add On For Acf And Scf
CVE-2025-12067
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-14371 - Simple Tags Plugin
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the taxopress_ai_add_post_term function in all versions up to, and including, 3.41.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to add or remove taxonomy terms (tags, categories) on any post, including ones they do not own.
PLUGIN
Simple Tags
CVE-2025-14371
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-13812 - Ranks In Wordpress Plugin
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipress_ajax_get_posts and gamipress_ajax_get_users functions in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate users, including their email addresses and to retrieve titles of private posts.
PLUGIN
Ranks In Wordpress
CVE-2025-13812
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2026-21411 - OpenBlocks IoT DX1 (FW5.0.x) Plugin
Authentication bypass issue exists in OpenBlocks series versions prior to FW5.0.8, which may allow an attacker to bypass administrator authentication and change the password.
PLUGIN
OpenBlocks IoT DX1 (FW5.0.x)
CVE-2026-21411
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-4776 - Phlox Theme
The Phlox theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` HTML attribute in all versions up to, and including, 2.17.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Phlox
CVE-2025-4776
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-13215 - Auxin Elements Plugin
The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.17.13 via the auxels_ajax_search due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract titles of draft posts that they should not have access to.
PLUGIN
Auxin Elements
CVE-2025-13215
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-15001 - Registration Password Plugin
The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
PLUGIN
Registration Password
CVE-2025-15001
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-14997 - Bp Xprofile Custom Field Types Plugin
The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_field' function in all versions up to, and including, 1.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Bp Xprofile Custom Field Types
CVE-2025-14997
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-14996 - As Password Field In Default Registration Form Plugin
The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
PLUGIN
As Password Field In Default Registration Form
CVE-2025-14996
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-14441 - Popup Builder Block Plugin
The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribers` REST API endpoint in all versions up to, and including, 2.2.0. This is due to the `permission_callback` only validating wp_rest nonce without checking user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary subscriber records.
PLUGIN
Popup Builder Block
CVE-2025-14441
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-14438 - Xagio Seo Plugin
The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixabayDownloadImage' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
PLUGIN
Xagio Seo
CVE-2025-14438
Risk Score
Threat Entry
Updated 2026-01-08
CVE-2025-14120 - Url Image Importer Plugin
The URL Image Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.7 due to insufficient sanitization of SVG files. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
PLUGIN
Url Image Importer
CVE-2025-14120
Risk Score
Threat Entry
Updated 2026-01-12
CVE-2026-21677 - iccDEV Plugin
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have Undefined Behavior in its CIccCLUT::Init function which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.
PLUGIN
iccDEV
CVE-2026-21677
Risk Score
Threat Entry
Updated 2026-01-12
CVE-2026-21676 - iccDEV Plugin
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have a Heap-based Buffer Overflow in its CIccMBB::Validate function which checks tag data validity. This issue is fixed in version 2.3.1.1.
PLUGIN
iccDEV
CVE-2026-21676
Risk Score
Threat Entry
Updated 2026-01-12
CVE-2026-21487 - iccDEV Plugin
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-of-range Pointer Offset and have Improper Input Validation in its CIccProfile::LoadTag function. This issue is fixed in version 2.3.1.2.
PLUGIN
iccDEV
CVE-2026-21487
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2026-21485 - iccDEV Plugin
iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below are prone to have Undefined Behavior (UB) and Out of Memory errors. This issue is fixed in version 2.3.1.2.
PLUGIN
iccDEV
CVE-2026-21485
Risk Score