Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-03
Academy - Security Vulnerability (CVE-2026-120544)
The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the…
PLUGIN
Academy
CVE-2026-120544
Risk Score
Threat Entry
Updated 2026-11-03
Advanced Custom Fields - Security Vulnerability (CVE-2026-120534)
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attackers to call arbitrary WordPress functions with controlled arguments. Method 1 requires the administrator to enable the non-default 'shortcode_preview' setting for the target form, while Method 2 requires the server environment to lack OpenSSL…
PLUGIN
Advanced Custom Fields
CVE-2026-120534
Risk Score
Threat Entry
Updated 2026-11-07
Buddypress Xprofile Image Field - Security Vulnerability (CVE-2026-120518)
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submitting a zero-byte file with the 'field_N_hidden' parameter during registration makes the plugin store the raw value, which is then resolved against the document root when the pending signup is activated. This makes it possible for unauthenticated attackers…
PLUGIN
Buddypress Xprofile Image Field
CVE-2026-120518
Risk Score
Threat Entry
Updated 2026-11-03
News Kit Elementor Addons - Security Vulnerability (CVE-2026-120524)
The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because an operator-precedence bug in handle_scripts() causes the admin bundle — and its inlined nekit-admin-nonce — to be enqueued on every admin screen…
PLUGIN
News Kit Elementor Addons
CVE-2026-120524
Risk Score
Threat Entry
Updated 2026-11-03
Wp Fastest Cache - Security Vulnerability (CVE-2026-111464)
The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site…
PLUGIN
Wp Fastest Cache
CVE-2026-111464
Risk Score
Threat Entry
Updated 2026-11-06
WordPress Core - Security Vulnerability (CVE-2026-119977)
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability Vendor/Product: WordPress WordPress Core Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Notes: https://wordpress.org/news/2026/10/wordpress-7-1-4 ; https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution ; BOD 26-04:…
CORE
WordPress Core
CVE-2026-119977
Risk Score
Threat Entry
Updated 2026-11-03
e-Commerce Plugin - Security Vulnerability (CVE-2026-120597)
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of…
PLUGIN
e-Commerce Plugin
CVE-2026-120597
Risk Score
Threat Entry
Updated 2026-11-08
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions - Security Vulnerability (CVE-2026-86596)
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including,
PLUGIN
s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
CVE-2026-86596
Risk Score
Threat Entry
Updated 2026-11-03
Ultimate Addons For Contact Form 7 - Security Vulnerability (CVE-2026-102435)
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation, as the WPCF7_Submission POP…
PLUGIN
Ultimate Addons For Contact Form 7
CVE-2026-102435
Risk Score
Threat Entry
Updated 2026-11-02
Bookit - Security Vulnerability (CVE-2026-62048)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.
PLUGIN
Bookit
CVE-2026-62048
Risk Score
Threat Entry
Updated 2026-11-02
Wp File Upload - Security Vulnerability (CVE-2026-66570)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.
PLUGIN
Wp File Upload
CVE-2026-66570
Risk Score
Threat Entry
Updated 2026-11-02
Jetformbuilder - Security Vulnerability (CVE-2026-119480)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
PLUGIN
Jetformbuilder
CVE-2026-119480
Risk Score
Threat Entry
Updated 2026-11-02
Media Library Assistant - Security Vulnerability (CVE-2026-113482)
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
PLUGIN
Media Library Assistant
CVE-2026-113482
Risk Score
Threat Entry
Updated 2026-11-02
MapPress - Security Vulnerability (CVE-2026-118168)
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.
PLUGIN
MapPress
CVE-2026-118168
Risk Score
Threat Entry
Updated 2026-11-02
Media Library Assistant - Security Vulnerability (CVE-2026-113481)
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authenticated user, such as a subscriber, to learn the term assignments of private attachments and posts.
PLUGIN
Media Library Assistant
CVE-2026-113481
Risk Score
Threat Entry
Updated 2026-11-02
Kali Forms - Security Vulnerability (CVE-2026-107343)
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any logged-in user, so a low-privileged user such as a Subscriber can make the site send email to an arbitrary recipient with a spoofed sender address.
PLUGIN
Kali Forms
CVE-2026-107343
Risk Score
Threat Entry
Updated 2026-11-02
Kali Forms - Security Vulnerability (CVE-2026-107342)
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relying only on a nonce that is available to any logged-in user, allowing authenticated users with minimal privileges (Subscriber and above) to disclose the email address of any registered user, including administrators.
PLUGIN
Kali Forms
CVE-2026-107342
Risk Score
Threat Entry
Updated 2026-11-02
Web 2.0 Directory - Security Vulnerability (CVE-2026-15272)
The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter in all versions up to, and including, 2.10.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Because the parameter is used in integer context without surrounding quotes, WordPress's built-in addslashes/magic_quotes escaping provides no protection against…
PLUGIN
Web 2.0 Directory
CVE-2026-15272
Risk Score
Threat Entry
Updated 2026-11-02
Nextgen Gallery - Security Vulnerability (CVE-2026-76010)
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supplied meta_data keys onto the image model combined with missing realpath containment in path construction and a bypassable signature check on the public image delivery route. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to own…
PLUGIN
Nextgen Gallery
CVE-2026-76010
Risk Score
Threat Entry
Updated 2026-11-02
Debug Log Manager - Security Vulnerability (CVE-2026-120114)
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has debug logging enabled with JS error logging active, and that the attacker can obtain the publicly emitted…
PLUGIN
Debug Log Manager
CVE-2026-120114
Risk Score