Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-30
Best Woocommerce Feed - Security Vulnerability (CVE-2026-118089)
Shop manager PHP Object Injection in Product Feed Manager
PLUGIN
Best Woocommerce Feed
CVE-2026-118089
Risk Score
Threat Entry
Updated 2026-10-30
Widget Options - Security Vulnerability (CVE-2026-116852)
Author Remote Code Execution (RCE) in Widget Options
PLUGIN
Widget Options
CVE-2026-116852
Risk Score
Threat Entry
Updated 2026-10-30
Wp Rest Cache - Security Vulnerability (CVE-2026-116862)
Unauthenticated Broken Access Control in WP REST Cache
PLUGIN
Wp Rest Cache
CVE-2026-116862
Risk Score
Threat Entry
Updated 2026-10-30
Flexible Chat - Security Vulnerability (CVE-2026-116861)
Unauthenticated Sensitive Data Exposure in Flexible Chat
PLUGIN
Flexible Chat
CVE-2026-116861
Risk Score
Threat Entry
Updated 2026-10-30
Customer Area - Security Vulnerability (CVE-2026-116854)
Subscriber Cross Site Scripting (XSS) in WP Customer Area
PLUGIN
Customer Area
CVE-2026-116854
Risk Score
Threat Entry
Updated 2026-10-30
Give - Security Vulnerability (CVE-2026-116853)
Unauthenticated Broken Access Control in GiveWP
PLUGIN
Give
CVE-2026-116853
Risk Score
Threat Entry
Updated 2026-10-30
Ecommerce Product Catalog - Security Vulnerability (CVE-2026-116851)
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog
PLUGIN
Ecommerce Product Catalog
CVE-2026-116851
Risk Score
Threat Entry
Updated 2026-10-30
Mangboard - Security Vulnerability (CVE-2026-116847)
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP
PLUGIN
Mangboard
CVE-2026-116847
Risk Score
Threat Entry
Updated 2026-10-30
Vikrentcar - Security Vulnerability (CVE-2026-116405)
Unauthenticated Cross Site Scripting (XSS) in VikRentCar
PLUGIN
Vikrentcar
CVE-2026-116405
Risk Score
Threat Entry
Updated 2026-10-30
Learning Management System - Security Vulnerability (CVE-2026-116410)
Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS
PLUGIN
Learning Management System
CVE-2026-116410
Risk Score
Threat Entry
Updated 2026-10-30
Sms Alert - Security Vulnerability (CVE-2026-116386)
Unauthenticated Privilege Escalation in SMS Alert Order Notifications
PLUGIN
Sms Alert
CVE-2026-116386
Risk Score
Threat Entry
Updated 2026-10-30
Woocommerce Products Filter - Security Vulnerability (CVE-2026-116401)
Unauthenticated Broken Access Control in HUSKY
PLUGIN
Woocommerce Products Filter
CVE-2026-116401
Risk Score
Threat Entry
Updated 2026-10-30
Woocommerce Products Filter - Security Vulnerability (CVE-2026-115947)
Unauthenticated Sensitive Data Exposure in HUSKY
PLUGIN
Woocommerce Products Filter
CVE-2026-115947
Risk Score
Threat Entry
Updated 2026-10-30
Dc Woocommerce Multi Vendor - Security Vulnerability (CVE-2026-114711)
Subscriber Cross Site Scripting (XSS) in MultiVendorX
PLUGIN
Dc Woocommerce Multi Vendor
CVE-2026-114711
Risk Score
Threat Entry
Updated 2026-10-30
Suredash - Security Vulnerability (CVE-2026-115604)
Subscriber Arbitrary File Deletion in SureDash
PLUGIN
Suredash
CVE-2026-115604
Risk Score
Threat Entry
Updated 2026-10-30
Yith Woocommerce Product Add Ons - Security Vulnerability (CVE-2026-107868)
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons
PLUGIN
Yith Woocommerce Product Add Ons
CVE-2026-107868
Risk Score
Threat Entry
Updated 2026-10-30
Ad Inserter - Security Vulnerability (CVE-2026-105077)
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter
PLUGIN
Ad Inserter
CVE-2026-105077
Risk Score
Threat Entry
Updated 2026-10-30
Booktics - Security Vulnerability (CVE-2026-104674)
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
PLUGIN
Booktics
CVE-2026-104674
Risk Score
Threat Entry
Updated 2026-10-30
Forminator Forms - Security Vulnerability (CVE-2026-97638)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue…
PLUGIN
Forminator Forms
CVE-2026-97638
Risk Score
Threat Entry
Updated 2026-10-30
Erp - Security Vulnerability (CVE-2026-96894)
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The inbound email router's only gate is a regex match on the References header for a reply token whose hash is never cryptographically validated, meaning any…
PLUGIN
Erp
CVE-2026-96894
Risk Score