Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-23
CVE-2026-8172 - Simple Basic Contact Form Plugin
The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input before reflecting it into the contact form output on validation errors, leading to a Reflected Cross-Site Scripting vulnerability that unauthenticated attackers can exploit against site visitors via a crafted link or cross-site form submission.
PLUGIN
Simple Basic Contact Form
CVE-2026-8172
Risk Score
Threat Entry
Updated 2026-06-23
CVE-2026-8378 - Frontend File Manager Plugin
The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filename submitted to the frontend file-rename endpoint before storing it as post meta and rendering it back on the admin File Manager listing, leading to a Stored Cross-Site Scripting vulnerability exploitable by users with Subscriber-level access and above against an administrator viewing the file management interface.
PLUGIN
Frontend File Manager Plugin
CVE-2026-8378
Risk Score
Threat Entry
Updated 2026-06-23
CVE-2026-8163 - Infility Global Plugin
The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.
PLUGIN
Infility Global
CVE-2026-8163
Risk Score
Threat Entry
Updated 2026-06-23
CVE-2026-7842 - Infility Global Infility Global Plugin
The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks before using them in SQL queries, allowing authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database. The ImportData module must be enabled via the Infility Global WordPress plugin before 2.15.20's module toggle page.
PLUGIN
Infility Global Infility Global
CVE-2026-7842
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-8157 - Allowing Authenticated Users With A Custom Vitepos Plugin
The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.
PLUGIN
Allowing Authenticated Users With A Custom Vitepos
CVE-2026-8157
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-7859 - Before 1 Plugin
The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify arbitrary post metadata, such as the gallery, featured image and, on WooCommerce sites, product prices.
PLUGIN
Before 1
CVE-2026-7859
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-6858 - Transbank Webpay Plugin
The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator
PLUGIN
Transbank Webpay
CVE-2026-6858
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-4259 - Ultimate Woocommerce Auction Pro Plugin
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Ultimate Woocommerce Auction Pro
CVE-2026-4259
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-4110 - Ultimate Woocommerce Auction Pro Plugin
The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Ultimate Woocommerce Auction Pro
CVE-2026-4110
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-10530 - Pie Register Plugin
The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a valid token and activate an account without access to the associated email inbox.
PLUGIN
Pie Register
CVE-2026-10530
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-11912 - Simple File List Plugin
The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() check unconditionally short-circuits the guard before that setting is evaluated.
PLUGIN
Simple File List
CVE-2026-11912
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-12119 - Simple File List Plugin
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attackers, with contributor-level access and above, to perform arbitrary file operations including deletion, move, folder creation, and download. An attacker can create a draft post containing the 'eeSFL' shortcode, render it via the post preview endpoint to harvest the nonce needed to authorize the operations, and then submit file operation requests that…
PLUGIN
Simple File List
CVE-2026-12119
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-11911 - Simple File List Plugin
The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The simplefilelist_edit_job AJAX action is registered via wp_ajax_nopriv_, making it accessible without authentication, and the is_admin() guard that would otherwise restrict access is bypassed because is_admin() always returns…
PLUGIN
Simple File List
CVE-2026-11911
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-9843 - Contact Form Entries Plugin
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page function in all versions up to, and including, 1.5.1. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Successful exploitation requires an administrator to view or edit the poisoned form entry, at which point PHP's bracket parser reshapes the attacker-crafted JSON…
PLUGIN
Contact Form Entries
CVE-2026-9843
Risk Score
Threat Entry
Updated 2026-06-23
CVE-2026-11551 - Branda White Labeling Plugin
The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
PLUGIN
Branda White Labeling
CVE-2026-11551
Risk Score
Threat Entry
Updated 2026-06-24
CVE-2026-12238 - Wp Google Maps Plugin
The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to create arbitrary records in plugin database tables (maps, markers, circles, polygons, polylines, rectangles, and point labels) by supplying a WPGMZA-namespaced CRUD-backed class name via the phpClass parameter. The namespace validation check (requiring the 'WPGMZA' prefix) does not prevent exploitation…
PLUGIN
Wp Google Maps
CVE-2026-12238
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-6798 - 2download Connector Plugin
The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 0.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view arbitrary customers' subscription data including subscription status, product names, order IDs, purchase dates, and expiry dates.
PLUGIN
2download Connector
CVE-2026-6798
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-3640 - Strabl A Checkout Solution Plugin
The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permission_callback of __return_true, which allows all incoming requests without any authentication or authorization checks. No shared secret, signature validation, HMAC verification, or token-based authentication is implemented. This makes it possible for unauthenticated attackers to create fraudulent WooCommerce orders and mark them as completed by supplying paymentStatus=paid, manipulate existing order statuses by providing an externalOrderId, create new…
PLUGIN
Strabl A Checkout Solution
CVE-2026-3640
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-9822 - Wp Hotel Booking Plugin
The WP Hotel Booking WordPress plugin before 2.3.1 does not enforce capability checks in several of its AJAX handlers, allowing authenticated users with Subscriber-level access to read other users' booking line items, enumerate active coupons, and read pricing data.
PLUGIN
Wp Hotel Booking
CVE-2026-9822
Risk Score
Threat Entry
Updated 2026-06-22
CVE-2026-9013 - Bogo Plugin
The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_translation. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the raw title, content, excerpt, and password of any private, draft, or password-protected post by triggering its duplication via the translation endpoint and reading the returned title.raw, content.raw, and excerpt.raw fields of the duplicated post. This vulnerability is exploitable against posts written in a non-default locale, as authenticated subscribers can request a translation into…
PLUGIN
Bogo
CVE-2026-9013
Risk Score