Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-29
CVE-2026-57328 - WordPress component
Subscriber Cross Site Scripting (XSS) in Business Directory
UNKNOWN
WordPress component
CVE-2026-57328
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-57320 - WordPress component
Unauthenticated Cross Site Scripting (XSS) in BEAR
UNKNOWN
WordPress component
CVE-2026-57320
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-57327 - WordPress component
Subscriber Broken Access Control in MainWP
UNKNOWN
WordPress component
CVE-2026-57327
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-57326 - WordPress component
Unauthenticated Cross Site Scripting (XSS) in Business Directory
UNKNOWN
WordPress component
CVE-2026-57326
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-57346 - Embed Privacy Plugin
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epiphyt Embed Privacy allows Path Traversal. This issue affects Embed Privacy: from n/a through 1.12.3.
PLUGIN
Embed Privacy
CVE-2026-57346
Risk Score
Threat Entry
Updated 2026-07-08
CVE-2026-57676 - Simple User Avatar Plugin
Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9.
PLUGIN
Simple User Avatar
CVE-2026-57676
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-9676 - F4 Post Tree Plugin
The F4 Post Tree WordPress plugin before 2.0.5 does not perform capability checks or CSRF/nonce verification on one of its AJAX actions, allowing authenticated users with Subscriber-level access and above to modify the parent and menu order of arbitrary posts.
PLUGIN
F4 Post Tree
CVE-2026-9676
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-10083 - Apcu Manager Plugin
The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an admin-area page, leading to a Stored Cross-Site Scripting vulnerability. When a persistent object cache is enabled, cache keys derived from unsanitised user input (e.g. a transient name created by another APCu Manager WordPress plugin before 4.5.0 from an unauthenticated request) are output without escaping and execute arbitrary JavaScript in the session of an administrator viewing the page.
PLUGIN
Apcu Manager
CVE-2026-10083
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-8095 - Nmedia User File Uploader Plugin
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during update_post_meta(), allowing an attacker to overwrite the stored file path with an arbitrary filesystem path that is then passed directly to unlink() in delete_file_locally() without any directory containment validation. This makes it possible for…
PLUGIN
Nmedia User File Uploader
CVE-2026-8095
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-9242 - Custom Registration Form Builder With Submission Manager Plugin
The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Verification of Data Authenticity in all versions up to and including 6.0.8.6. This is due to the PayPal IPN `callback` handler being registered as a nopriv AJAX action with no authentication or nonce requirement, and critically because the handler updates the payment log database row with attacker-controlled POST data — including `payment_status` and the `custom` field encoding the target `user_id` — before PayPal IPN validation is performed, meaning…
PLUGIN
Custom Registration Form Builder With Submission Manager
CVE-2026-9242
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-9233 - Quiz Master Next Plugin
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table, including storing unsanitized HTML content such as arbitrary script tags.
PLUGIN
Quiz Master Next
CVE-2026-9233
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-3462 - Reepay Checkout Gateway Plugin
The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary CSV data and overwrite WooCommerce payment tokens, postmeta, and order meta records.
PLUGIN
Reepay Checkout Gateway
CVE-2026-3462
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-13295 - Siteorigin Panels Plugin
The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via panels_data Parameter in all versions up to, and including, 2.34.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the nonce and edit_post capability checks enforced during save are both satisfied by Contributor-level users for their own posts, and the panels_data value is…
PLUGIN
Siteorigin Panels
CVE-2026-13295
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-11783 - Dokan Lite Plugin
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Product SKU in all versions up to, and including, 5.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered to site visitors — including unauthenticated users — when the store search widget…
PLUGIN
Dokan Lite
CVE-2026-11783
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-12432 - Wp Full Stripe Free Plugin
The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_nopriv_ hooks and the underlying update_failed_payment_status() function performs no capability check, no nonce verification, and no logged-in check before calling $this->db->updatePaymentByEventId() with attacker-controlled POST parameters. This makes it possible for unauthenticated attackers who can obtain a valid Stripe Payment Intent ID for the target site (Payment Intent IDs are exposed to the customer browser during normal Stripe.js…
PLUGIN
Wp Full Stripe Free
CVE-2026-12432
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-12399 - Gutenverse Plugin
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
PLUGIN
Gutenverse
CVE-2026-12399
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-12471 - Spexo Theme
The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate a limited set of plugins.
THEME
Spexo
CVE-2026-12471
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-11987 - Dokan Lite Plugin
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.4 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to read any other vendor's products — including unpublished draft and pending listings — exposing product names, prices, SKUs, and descriptions belonging to other vendors. The permission callbacks for both the collection…
PLUGIN
Dokan Lite
CVE-2026-11987
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-11773 - Learning Management System Plugin
The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with student-level access and above, to modify the description (post content) of arbitrary course announcements authored by instructors or administrators.
PLUGIN
Learning Management System
CVE-2026-11773
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-11597 - Surbma Infusionsoft Shortcode Plugin
The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied 'account' and 'id' shortcode attributes in the surbma_infusionsoft_shortcode_shortcode() function, which are concatenated directly into a tag's src attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Surbma Infusionsoft Shortcode
CVE-2026-11597
Risk Score