Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-02
Security Optimizer - Security Vulnerability (CVE-2026-118185)
The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor and take over the account.
PLUGIN
Security Optimizer
CVE-2026-118185
Risk Score
Threat Entry
Updated 2026-11-02
Bulk Media Register - Security Vulnerability (CVE-2026-118043)
The Bulk Media Register WordPress plugin before 2.01 does not properly validate a user-supplied path before moving a file on the server, allowing users with the Author role to move or rename arbitrary files, including outside the WordPress root, which can defeat directory-level access controls and disclose protected files.
PLUGIN
Bulk Media Register
CVE-2026-118043
Risk Score
Threat Entry
Updated 2026-11-02
Firelight Lightbox - Security Vulnerability (CVE-2026-118438)
The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affected content.
PLUGIN
Firelight Lightbox
CVE-2026-118438
Risk Score
Threat Entry
Updated 2026-11-02
Premium Packages - Security Vulnerability (CVE-2026-118184)
The Premium Packages WordPress plugin before 7.2.2 does not prevent unauthenticated visitors from overwriting the stored price of items in their shopping cart, allowing them to create orders for any product at an arbitrary total of their choosing.
PLUGIN
Premium Packages
CVE-2026-118184
Risk Score
Threat Entry
Updated 2026-11-02
BuddyForms - Security Vulnerability (CVE-2026-118437)
The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting guest-uploaded attachments, allowing unauthenticated attackers to permanently delete media files uploaded by other unauthenticated visitors.
PLUGIN
BuddyForms
CVE-2026-118437
Risk Score
Threat Entry
Updated 2026-11-02
Password Protect Page - Security Vulnerability (CVE-2026-116520)
The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / shortcode attribute desc_below_form (and placeholder as the marker-smuggling helper)' parameter in all versions up to, and including, 1.9.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because WordPress's comment_content filter leaves bare shortcode text (containing no HTML tags) untouched, and the…
PLUGIN
Password Protect Page
CVE-2026-116520
Risk Score
Threat Entry
Updated 2026-11-02
Nextgen Gallery - Security Vulnerability (CVE-2026-116563)
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have Shutter or Shutter Reloaded selected as the active lightbox, and the injected comment must be approved through WordPress's standard moderation…
PLUGIN
Nextgen Gallery
CVE-2026-116563
Risk Score
Threat Entry
Updated 2026-11-02
Payment Forms for Paystack - Security Vulnerability (CVE-2026-110042)
The Payment Forms for Paystack WordPress plugin before 4.0.6 does not properly restrict access to a page that displays its stored configuration, allowing users with the Contributor role and above to view secret payment-gateway API credentials, both the live and test secret keys, which grant full access to the site owner's payment account.
PLUGIN
Payment Forms for Paystack
CVE-2026-110042
Risk Score
Threat Entry
Updated 2026-11-02
Essential Addons for Elementor - Security Vulnerability (CVE-2026-110808)
The Essential Addons for Elementor WordPress plugin before 6.8.8 does not correctly restrict who may set the role assigned to accounts created through its registration form, allowing authenticated users with Author-level access and above to cause newly registered accounts, including those created by unauthenticated visitors through the public registration form, to be granted a higher role such as Editor. This is an incomplete fix of CVE-2026-5193: the role-validation control added in 6.6.0 can be circumvented by a lower-privileged user, so versions 6.6.0 through 6.8.7 remain affected even on sites that…
PLUGIN
Essential Addons for Elementor
CVE-2026-110808
Risk Score
Threat Entry
Updated 2026-11-02
Ninja Forms - Security Vulnerability (CVE-2026-109997)
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nf_ajax_submit endpoint issues a valid nonce to any requester on failure, effectively neutralizing the nonce check and making exploitation trivially achievable…
PLUGIN
Ninja Forms
CVE-2026-109997
Risk Score
Threat Entry
Updated 2026-11-02
Meow Lightbox - Security Vulnerability (CVE-2026-109234)
The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply body)' parameter in all versions up to, and including, 5.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the administrator to have enabled Output Buffering, the HtmlDomParser engine, and Aggressive Resolve, as well as a stored-HTML submission surface (such as bbPress anonymous replies) whose kses allow-list preserves…
PLUGIN
Meow Lightbox
CVE-2026-109234
Risk Score
Threat Entry
Updated 2026-11-05
The Ninja Forms - Security Vulnerability (CVE-2026-101326)
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. Exploitation requires that an administrator has configured at least one Ninja Forms field with its Default Value set to…
PLUGIN
The Ninja Forms
CVE-2026-101326
Risk Score
Threat Entry
Updated 2026-11-02
The Ninja Forms - Security Vulnerability (CVE-2026-100155)
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
The Ninja Forms
CVE-2026-100155
Risk Score
Threat Entry
Updated 2026-11-02
PDF Invoices & Packing Slips for WooCommerce - Security Vulnerability (CVE-2026-111578)
The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.
PLUGIN
PDF Invoices & Packing Slips for WooCommerce
CVE-2026-111578
Risk Score
Threat Entry
Updated 2026-10-30
Change Wp Admin Login - Security Vulnerability (CVE-2026-94175)
Unauthenticated Cross Site Scripting (XSS) in All In One Login
PLUGIN
Change Wp Admin Login
CVE-2026-94175
Risk Score
Threat Entry
Updated 2026-10-30
Leadsnap - Security Vulnerability (CVE-2026-90888)
Unauthenticated PHP Object Injection in LeadSnap
PLUGIN
Leadsnap
CVE-2026-90888
Risk Score
Threat Entry
Updated 2026-10-30
Gs Testimonial - Security Vulnerability (CVE-2026-78527)
Contributor PHP Object Injection in GS Testimonial Slider
PLUGIN
Gs Testimonial
CVE-2026-78527
Risk Score
Threat Entry
Updated 2026-10-30
Enable Media Replace - Security Vulnerability (CVE-2026-73186)
Subscriber PHP Object Injection in Enable Media Replace
PLUGIN
Enable Media Replace
CVE-2026-73186
Risk Score
Threat Entry
Updated 2026-10-30
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-62121)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-62121
Risk Score
Threat Entry
Updated 2026-10-30
Booktics - Security Vulnerability (CVE-2026-62122)
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
PLUGIN
Booktics
CVE-2026-62122
Risk Score