Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-26
CVE-2026-54821 - WordPress component
Subscriber Sensitive Data Exposure in Visual Link Preview
UNKNOWN
WordPress component
CVE-2026-54821
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-27366 - WordPress component
Unauthenticated Broken Access Control in MainWP Child
UNKNOWN
WordPress component
CVE-2026-27366
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-12937 - Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin Theme
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The AJAX handler is registered for unauthenticated users via…
THEME
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin
CVE-2026-12937
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-5305 - Email Address Encoder Plugin
The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks
PLUGIN
Email Address Encoder
CVE-2026-5305
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-9702 - Inpost Pl Plugin
The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.
PLUGIN
Inpost Pl
CVE-2026-9702
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-10824 - Masteriyo Lms Plugin
The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.
PLUGIN
Masteriyo Lms
CVE-2026-10824
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-2508 - Gravity Bookings Plugin
The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Gravity Bookings
CVE-2026-2508
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-12077 - Dokan Pro Plugin
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Dokan Pro
CVE-2026-12077
Risk Score
Threat Entry
Updated 2026-06-26
CVE-2026-12079 - Dokan Pro Plugin
The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Dokan Pro
CVE-2026-12079
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-10833 - Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Plugin
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configurablePrefix' Block Attribute in all versions up to, and including, 6.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
CVE-2026-10833
Risk Score
Threat Entry
Updated 2026-07-14
CVE-2026-53038 - Linux Plugin
In the Linux kernel, the following vulnerability has been resolved: ima_fs: Correctly create securityfs files for unsupported hash algos ima_tpm_chip->allocated_banks[i].crypto_id is initialized to HASH_ALGO__LAST if the TPM algorithm is not supported. However there are places relying on the algorithm to be valid because it is accessed by hash_algo_name[]. On 6.12.40 I observe the following read out-of-bounds in hash_algo_name: ================================================================== BUG: KASAN: global-out-of-bounds in create_securityfs_measurement_lists+0x396/0x440 Read of size 8 at addr ffffffff83e18138 by task swapper/0/1 CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.40 #3 Call Trace: dump_stack_lvl+0x61/0x90 print_report+0xc4/0x580…
PLUGIN
Linux
CVE-2026-53038
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-12242 - Adrotate Banner Manager Plugin
The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode. This is due to insufficient input validation and sanitization of the banner shortcode attribute before concatenation into a PHP code string wrapped in W3 Total Cache mfunc or Borlabs Cache fragment markers. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute arbitrary PHP code on the server. This vulnerability requires W3 Total Cache or Borlabs Cache…
PLUGIN
Adrotate Banner Manager
CVE-2026-12242
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-7761 - Ultimate Member Plugin
The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: (1) an MD5 hash fallback in get_directory_by_hash() that allows any post to be used as a member directory by computing SUBSTRING(MD5(post_id), 11, 5), (2) a strstr() parsing logic flaw in post_data() that allows bypassing WordPress's protected meta key restrictions by placing '_um_' anywhere in the meta key name rather than at the start, and (3) missing…
PLUGIN
Ultimate Member
CVE-2026-7761
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-56052 - Funnel Builder by FunnelKit Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.
PLUGIN
Funnel Builder by FunnelKit
CVE-2026-56052
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-9710 - Before 7 Plugin
The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.8 (v0.8.x) on the .org repository.
PLUGIN
Before 7
CVE-2026-9710
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-9709 - Before 7 Plugin
The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone WordPress plugin before 7.8.9 (v0.8.x) on the .org repository.
PLUGIN
Before 7
CVE-2026-9709
Risk Score
Threat Entry
Updated 2026-06-29
CVE-2026-9643 - Wp Meta Seo Plugin
The WP Meta SEO plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REQUEST_URI server variable in all versions up to, and including, 4.5.18. When the plugin's `wpmsTemplateRedirect()` hook detects a 404, it concatenates `$_SERVER['HTTP_HOST']` with the raw `$_SERVER['REQUEST_URI']` and inserts that value verbatim into the `wp_wpms_links.link_url` column via `$wpdb->insert()`. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever an administrator views the plugin's 404 & Redirects admin page (`/wp-admin/admin.php?page=metaseo_broken_link`).
PLUGIN
Wp Meta Seo
CVE-2026-9643
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-9724 - Motordesk Plugin
The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the motordesk_admin_home function. This makes it possible for unauthenticated attackers to update the plugin's configuration settings, including the search page URI and custom template directory path via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Motordesk
CVE-2026-9724
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-9721 - Book A Room Event Calendar Plugin
The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the settings_form()/update_settings() functionality. The plugin's options page handler dispatches on the 'action' POST parameter and calls update_settings(), which persists plugin configuration (including the external database host, username, password, prefix, database name, encryption key, and registration page URL) via update_option(), without ever generating a nonce field in the settings form or verifying one (no wp_nonce_field(), check_admin_referer(), or wp_verify_nonce()…
PLUGIN
Book A Room Event Calendar
CVE-2026-9721
Risk Score
Threat Entry
Updated 2026-06-25
CVE-2026-9179 - Wp Forms Connector Plugin
The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() function, where the value is concatenated unquoted into the ORDER BY clause and executed via $wpdb->get_results() without $wpdb->prepare(). The endpoint is registered with permission_callback '__return_true' and performs only a broken header-based…
PLUGIN
Wp Forms Connector
CVE-2026-9179
Risk Score