Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-11
Eupago Gateway For Woocommerce - Security Vulnerability (CVE-2026-91075)
The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 before 4.7.6 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it.
PLUGIN
Eupago Gateway For Woocommerce
CVE-2026-91075
Risk Score
Threat Entry
Updated 2026-11-04
from 3 - Security Vulnerability (CVE-2026-103327)
The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made.
PLUGIN
from 3
CVE-2026-103327
Risk Score
Threat Entry
Updated 2026-11-04
AZEXO Store Locator - Security Vulnerability (CVE-2026-115205)
The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages.
PLUGIN
AZEXO Store Locator
CVE-2026-115205
Risk Score
Threat Entry
Updated 2026-11-04
Gallery for Social Photo - Security Vulnerability (CVE-2026-105967)
The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.
PLUGIN
Gallery for Social Photo
CVE-2026-105967
Risk Score
Threat Entry
Updated 2026-11-04
DT LMS - Security Vulnerability (CVE-2026-106004)
The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.
PLUGIN
DT LMS
CVE-2026-106004
Risk Score
Threat Entry
Updated 2026-11-04
DT Directory Lite Addon - Security Vulnerability (CVE-2026-105993)
The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.
PLUGIN
DT Directory Lite Addon
CVE-2026-105993
Risk Score
Threat Entry
Updated 2026-11-04
weMail - Security Vulnerability (CVE-2026-104648)
The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.
PLUGIN
weMail
CVE-2026-104648
Risk Score
Threat Entry
Updated 2026-11-04
weMail - Security Vulnerability (CVE-2026-104647)
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.
PLUGIN
weMail
CVE-2026-104647
Risk Score
Threat Entry
Updated 2026-11-04
WATI Chat and Notification - Security Vulnerability (CVE-2026-103379)
The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected.
PLUGIN
WATI Chat and Notification
CVE-2026-103379
Risk Score
Threat Entry
Updated 2026-11-08
Fluent Cart - Security Vulnerability (CVE-2026-120577)
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with custom-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
PLUGIN
Fluent Cart
CVE-2026-120577
Risk Score
Threat Entry
Updated 2026-11-03
Wplr Sync - Security Vulnerability (CVE-2026-120575)
The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy[].name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscribers because the /?wplr-sync-api endpoint authenticates solely via wplr_auth_token usermeta with no capability check, and the current user's token is exposed…
PLUGIN
Wplr Sync
CVE-2026-120575
Risk Score
Threat Entry
Updated 2026-11-03
Ai Alt Text Generator - Security Vulnerability (CVE-2026-120578)
The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the alt text, and optionally the title, caption, and description of arbitrary attachments owned by other users. Exploiting this vulnerability requires a Contributor-level account to retrieve the nonce from the page source of post.php, post-new.php, or upload.php; additionally, overwriting post_title, post_excerpt, and…
PLUGIN
Ai Alt Text Generator
CVE-2026-120578
Risk Score
Threat Entry
Updated 2026-11-03
Surecart - Security Vulnerability (CVE-2026-120574)
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission callback returns true) resolves an attacker-supplied login to any WordPress user, verifies a 6-digit code, and on success calls $user->login() → wp_set_auth_cookie() for a user of any role. In the affected versions this path has no per-account attempt counter, no persistent email/IP lockout or rate limit (the upstream CDN throttle is bypassable via IP rotation), and no restriction preventing high-privilege accounts from…
PLUGIN
Surecart
CVE-2026-120574
Risk Score
Threat Entry
Updated 2026-11-08
Contact Form Extender For Divi Builder - Security Vulnerability (CVE-2026-120559)
The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.
PLUGIN
Contact Form Extender For Divi Builder
CVE-2026-120559
Risk Score
Threat Entry
Updated 2026-11-03
Woo Advanced Shipment Tracking - Security Vulnerability (CVE-2026-120558)
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders//shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append…
PLUGIN
Woo Advanced Shipment Tracking
CVE-2026-120558
Risk Score
Threat Entry
Updated 2026-11-03
Jetformbuilder - Security Vulnerability (CVE-2026-120561)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update…
PLUGIN
Jetformbuilder
CVE-2026-120561
Risk Score
Threat Entry
Updated 2026-11-07
Woocommerce Multilingual - Security Vulnerability (CVE-2026-120563)
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the…
PLUGIN
Woocommerce Multilingual
CVE-2026-120563
Risk Score
Threat Entry
Updated 2026-11-08
Easy Digital Downloads - Security Vulnerability (CVE-2026-120538)
The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled…
PLUGIN
Easy Digital Downloads
CVE-2026-120538
Risk Score
Threat Entry
Updated 2026-11-03
Seo Engine - Security Vulnerability (CVE-2026-120552)
The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded…
PLUGIN
Seo Engine
CVE-2026-120552
Risk Score
Threat Entry
Updated 2026-11-07
Wp Compress Image Optimizer - Security Vulnerability (CVE-2026-120551)
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to link the victim site to an attacker-controlled WP Compress account, overwrite plugin settings to an aggressive live-CDN preset, and gain the shared api_key that authenticates all nopriv HMAC-gated endpoints — enabling full control over cache purging, file deletion, opcode…
PLUGIN
Wp Compress Image Optimizer
CVE-2026-120551
Risk Score