Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-04
Text Typing - Security Vulnerability (CVE-2026-115250)
The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page.
PLUGIN
Text Typing
CVE-2026-115250
Risk Score
Threat Entry
Updated 2026-11-04
istrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid - Security Vulnerability (CVE-2026-115243)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking disabled, so an authenticated administrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137's import directory. This is an incomplete fix of CVE-2025-5961, whose extension check was applied to…
PLUGIN
istrator can store a file with an arbitrary extension, including a PHP file, in the WPvivid
CVE-2026-115243
Risk Score
Threat Entry
Updated 2026-11-04
dministrator can supply the site's table prefix, or any other string, and cause the WPvivid - Security Vulnerability (CVE-2026-115241)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created before using it as a database table-name prefix, so an authenticated administrator can supply the site's table prefix, or any other string, and cause the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 to drop every matching table, including the core WordPress tables, destroying the site's database.
PLUGIN
dministrator can supply the site's table prefix, or any other string, and cause the WPvivid
CVE-2026-115241
Risk Score
Threat Entry
Updated 2026-11-04
ticated administrator can supply a path containing traversal sequences and make the WPvivid - Security Vulnerability (CVE-2026-115242)
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.
PLUGIN
ticated administrator can supply a path containing traversal sequences and make the WPvivid
CVE-2026-115242
Risk Score
Threat Entry
Updated 2026-11-04
WP Roster - Security Vulnerability (CVE-2026-115257)
The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to overwrite, wipe or restore the content of any roster.
PLUGIN
WP Roster
CVE-2026-115257
Risk Score
Threat Entry
Updated 2026-11-04
Enable Media Replace - Security Vulnerability (CVE-2026-114431)
The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads.
PLUGIN
Enable Media Replace
CVE-2026-114431
Risk Score
Threat Entry
Updated 2026-11-04
efore 5.1.0, duplicator-pro - Security Vulnerability (CVE-2026-112244)
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
PLUGIN
efore 5.1.0, duplicator-pro
CVE-2026-112244
Risk Score
Threat Entry
Updated 2026-11-04
Essential Real Estate - Security Vulnerability (CVE-2026-110964)
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those owned by administrators.
PLUGIN
Essential Real Estate
CVE-2026-110964
Risk Score
Threat Entry
Updated 2026-11-04
efore 5.1.0, duplicator-pro - Security Vulnerability (CVE-2026-112243)
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.
PLUGIN
efore 5.1.0, duplicator-pro
CVE-2026-112243
Risk Score
Threat Entry
Updated 2026-11-04
PowerPack Addons for Elementor - Security Vulnerability (CVE-2026-110692)
The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a server-side HTTP request, which could allow users with the contributor role and above to perform Server-Side Request Forgery attacks against internal and loopback resources and read the response back.
PLUGIN
PowerPack Addons for Elementor
CVE-2026-110692
Risk Score
Threat Entry
Updated 2026-11-04
FV Flowplayer Video Player - Security Vulnerability (CVE-2026-108068)
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by a nonce only, allowing users with Contributor-level permissions and above to disclose and bulk-modify the FV Flowplayer Video Player WordPress plugin before 7.5.56.7212's stored video records across the whole site.
PLUGIN
FV Flowplayer Video Player
CVE-2026-108068
Risk Score
Threat Entry
Updated 2026-11-04
FV Flowplayer Video Player - Security Vulnerability (CVE-2026-108067)
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete arbitrary records belonging to other users, and to disclose the associated meta data in the response.
PLUGIN
FV Flowplayer Video Player
CVE-2026-108067
Risk Score
Threat Entry
Updated 2026-11-04
WP Remote Users Sync - Security Vulnerability (CVE-2026-111962)
The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web root, relying on an Apache access-control file that other web servers such as Nginx ignore, which allows an unauthenticated attacker who requests the export's predictable file name while it is present to retrieve the exported users' personal data.
PLUGIN
WP Remote Users Sync
CVE-2026-111962
Risk Score
Threat Entry
Updated 2026-11-04
Post Duplicator - Security Vulnerability (CVE-2026-111740)
The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.
PLUGIN
Post Duplicator
CVE-2026-111740
Risk Score
Threat Entry
Updated 2026-11-04
Form Maker by 10Web - Security Vulnerability (CVE-2026-105413)
The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing unauthenticated users to store a payload that executes as arbitrary web scripts in the session of an administrator who views the submissions.
PLUGIN
Form Maker by 10Web
CVE-2026-105413
Risk Score
Threat Entry
Updated 2026-11-04
ng settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress - Security Vulnerability (CVE-2026-108041)
The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end.
PLUGIN
ng settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress
CVE-2026-108041
Risk Score
Threat Entry
Updated 2026-11-04
Kali Forms - Security Vulnerability (CVE-2026-106649)
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator.
PLUGIN
Kali Forms
CVE-2026-106649
Risk Score
Threat Entry
Updated 2026-11-04
CookieYes - Security Vulnerability (CVE-2026-104719)
The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.
PLUGIN
CookieYes
CVE-2026-104719
Risk Score
Threat Entry
Updated 2026-11-04
Booking Package - Security Vulnerability (CVE-2026-106000)
The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment, allowing unauthenticated users to create confirmed bookings without paying.
PLUGIN
Booking Package
CVE-2026-106000
Risk Score
Threat Entry
Updated 2026-11-04
ERP - Security Vulnerability (CVE-2026-105191)
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.
PLUGIN
ERP
CVE-2026-105191
Risk Score