Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-04
Mollie Payments for WooCommerce - Security Vulnerability (CVE-2026-101166)
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products.
PLUGIN
Mollie Payments for WooCommerce
CVE-2026-101166
Risk Score
Threat Entry
Updated 2026-11-04
Mollie Payments for WooCommerce - Security Vulnerability (CVE-2026-101165)
The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment.
PLUGIN
Mollie Payments for WooCommerce
CVE-2026-101165
Risk Score
Threat Entry
Updated 2026-11-03
Headless CMS - Security Vulnerability (CVE-2026-121509)
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
PLUGIN
Headless CMS
CVE-2026-121509
Risk Score
Threat Entry
Updated 2026-11-03
Mycred - Security Vulnerability (CVE-2026-97072)
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
PLUGIN
Mycred
CVE-2026-97072
Risk Score
Threat Entry
Updated 2026-11-04
Wc Multivendor Membership - Security Vulnerability (CVE-2026-39743)
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
PLUGIN
Wc Multivendor Membership
CVE-2026-39743
Risk Score
Threat Entry
Updated 2026-11-07
Wc Multivendor Membership - Security Vulnerability (CVE-2026-39777)
Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.
PLUGIN
Wc Multivendor Membership
CVE-2026-39777
Risk Score
Threat Entry
Updated 2026-11-06
Posts Data Table - Security Vulnerability (CVE-2026-120843)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.
PLUGIN
Posts Data Table
CVE-2026-120843
Risk Score
Threat Entry
Updated 2026-11-07
Uncanny Automator - Security Vulnerability (CVE-2026-120846)
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through 7.7.1.
PLUGIN
Uncanny Automator
CVE-2026-120846
Risk Score
Threat Entry
Updated 2026-11-06
Paid Member Subscriptions - Security Vulnerability (CVE-2026-119521)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.
PLUGIN
Paid Member Subscriptions
CVE-2026-119521
Risk Score
Threat Entry
Updated 2026-11-03
Clickcease Click Fraud Protection - Security Vulnerability (CVE-2026-119509)
Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0.
PLUGIN
Clickcease Click Fraud Protection
CVE-2026-119509
Risk Score
Threat Entry
Updated 2026-11-03
Better Search - Security Vulnerability (CVE-2026-119495)
Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2.
PLUGIN
Better Search
CVE-2026-119495
Risk Score
Threat Entry
Updated 2026-11-03
Dokan Lite - Security Vulnerability (CVE-2026-119487)
Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.
PLUGIN
Dokan Lite
CVE-2026-119487
Risk Score
Threat Entry
Updated 2026-11-09
Dokan Lite - Security Vulnerability (CVE-2026-119485)
Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.
PLUGIN
Dokan Lite
CVE-2026-119485
Risk Score
Threat Entry
Updated 2026-11-03
Forminator - Security Vulnerability (CVE-2026-116859)
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.
PLUGIN
Forminator
CVE-2026-116859
Risk Score
Threat Entry
Updated 2026-11-04
Forminator - Security Vulnerability (CVE-2026-116858)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.
PLUGIN
Forminator
CVE-2026-116858
Risk Score
Threat Entry
Updated 2026-11-03
Anywhere Elementor - Security Vulnerability (CVE-2026-114185)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
PLUGIN
Anywhere Elementor
CVE-2026-114185
Risk Score
Threat Entry
Updated 2026-11-07
Anywhere Elementor - Security Vulnerability (CVE-2026-114183)
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
PLUGIN
Anywhere Elementor
CVE-2026-114183
Risk Score
Threat Entry
Updated 2026-11-04
Anywhere Elementor - Security Vulnerability (CVE-2026-114187)
Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
PLUGIN
Anywhere Elementor
CVE-2026-114187
Risk Score
Threat Entry
Updated 2026-11-03
Mycred - Security Vulnerability (CVE-2026-103077)
Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.
PLUGIN
Mycred
CVE-2026-103077
Risk Score
Threat Entry
Updated 2026-11-07
BuddyBoss App - Security Vulnerability (CVE-2026-76124)
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access…
PLUGIN
BuddyBoss App
CVE-2026-76124
Risk Score