Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-04
Doofinder For Woocommerce - Security Vulnerability (CVE-2026-56065)
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2.
PLUGIN
Doofinder For Woocommerce
CVE-2026-56065
Risk Score
Threat Entry
Updated 2026-11-04
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-62007)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-62007
Risk Score
Threat Entry
Updated 2026-11-04
Customer Area - Security Vulnerability (CVE-2026-57666)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.
PLUGIN
Customer Area
CVE-2026-57666
Risk Score
Threat Entry
Updated 2026-11-04
Wp Booking System - Security Vulnerability (CVE-2026-57639)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6.
PLUGIN
Wp Booking System
CVE-2026-57639
Risk Score
Threat Entry
Updated 2026-11-04
Simple Cloudflare Turnstile - Security Vulnerability (CVE-2026-57775)
Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.1.
PLUGIN
Simple Cloudflare Turnstile
CVE-2026-57775
Risk Score
Threat Entry
Updated 2026-11-04
Wp Photo Album Plus - Security Vulnerability (CVE-2026-119477)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003.
PLUGIN
Wp Photo Album Plus
CVE-2026-119477
Risk Score
Threat Entry
Updated 2026-11-04
Wpdiscuz - Security Vulnerability (CVE-2026-119366)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73.
PLUGIN
Wpdiscuz
CVE-2026-119366
Risk Score
Threat Entry
Updated 2026-11-04
Customer Area - Security Vulnerability (CVE-2026-54861)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.
PLUGIN
Customer Area
CVE-2026-54861
Risk Score
Threat Entry
Updated 2026-11-04
Wc Multivendor Marketplace - Security Vulnerability (CVE-2026-62000)
Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.2.
PLUGIN
Wc Multivendor Marketplace
CVE-2026-62000
Risk Score
Threat Entry
Updated 2026-11-04
Wpforms Lite - Security Vulnerability (CVE-2026-54851)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3.
PLUGIN
Wpforms Lite
CVE-2026-54851
Risk Score
Threat Entry
Updated 2026-11-04
Stape Conversion Tracking - Security Vulnerability (CVE-2026-118422)
The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned from the site's own origin with security response headers stripped, leading to Server-Side Request Forgery, including loopback and internal hosts, and Cross-Site Scripting.
PLUGIN
Stape Conversion Tracking
CVE-2026-118422
Risk Score
Threat Entry
Updated 2026-11-04
VikWidgetsLoader - Security Vulnerability (CVE-2026-118983)
The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.
PLUGIN
VikWidgetsLoader
CVE-2026-118983
Risk Score
Threat Entry
Updated 2026-11-04
All-in-One Video Gallery - Security Vulnerability (CVE-2026-118783)
The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
All-in-One Video Gallery
CVE-2026-118783
Risk Score
Threat Entry
Updated 2026-11-04
EventPrime - Security Vulnerability (CVE-2026-118523)
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
PLUGIN
EventPrime
CVE-2026-118523
Risk Score
Threat Entry
Updated 2026-11-04
Simple Download Monitor - Security Vulnerability (CVE-2026-118637)
The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.
PLUGIN
Simple Download Monitor
CVE-2026-118637
Risk Score
Threat Entry
Updated 2026-11-04
WPvivid - Security Vulnerability (CVE-2026-115426)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
PLUGIN
WPvivid
CVE-2026-115426
Risk Score
Threat Entry
Updated 2026-11-04
Premium Packages - Security Vulnerability (CVE-2026-118407)
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and download their purchased files, by supplying only the order identifier.
PLUGIN
Premium Packages
CVE-2026-118407
Risk Score
Threat Entry
Updated 2026-11-04
Premium Packages - Security Vulnerability (CVE-2026-118404)
The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.
PLUGIN
Premium Packages
CVE-2026-118404
Risk Score
Threat Entry
Updated 2026-11-04
efore 5.1.0, duplicator-pro - Security Vulnerability (CVE-2026-115262)
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
PLUGIN
efore 5.1.0, duplicator-pro
CVE-2026-115262
Risk Score
Threat Entry
Updated 2026-11-04
Premium Packages - Security Vulnerability (CVE-2026-118403)
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
PLUGIN
Premium Packages
CVE-2026-118403
Risk Score