Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-30
Gravity Forms - Security Vulnerability (CVE-2026-97645)
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the administrator to click the injected link in the entry detail view and confirm a dialog, which triggers the admin JavaScript bundle's delegated data-dialog-callback handler to invoke the attacker-supplied function reference.
PLUGIN
Gravity Forms
CVE-2026-97645
Risk Score
Threat Entry
Updated 2026-10-30
Formidable Forms - Security Vulnerability (CVE-2026-89435)
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the…
PLUGIN
Formidable Forms
CVE-2026-89435
Risk Score
Threat Entry
Updated 2026-10-30
Gravity Forms - Security Vulnerability (CVE-2026-90437)
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields allow raw HTML submissions via allow_html(), and an entity-encoded payload stored in…
PLUGIN
Gravity Forms
CVE-2026-90437
Risk Score
Threat Entry
Updated 2026-10-30
Food Store - Security Vulnerability (CVE-2026-116622)
The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have the 'Enable Checkout Service Fields' option turned off, which is a non-default configuration, while 'Enable Pickup/Delivery Service' remains enabled.
PLUGIN
Food Store
CVE-2026-116622
Risk Score
Threat Entry
Updated 2026-10-30
Ai Engine - Security Vulnerability (CVE-2026-110732)
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration endpoint (/wp-json/mcp/v1/oauth/register) being registered with a permission_callback of __return_true, allowing an unauthenticated user to register an active OAuth client with an attacker-controlled redirect URI. This makes it possible for unauthenticated attackers to obtain an administrator-bound MCP access token, and thereby full administrator-level control through the MCP tools (including user creation…
PLUGIN
Ai Engine
CVE-2026-110732
Risk Score
Threat Entry
Updated 2026-10-30
Gravity Forms - Security Vulnerability (CVE-2026-103039)
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject…
PLUGIN
Gravity Forms
CVE-2026-103039
Risk Score
Threat Entry
Updated 2026-10-30
Joomsport Sports League Results Management - Security Vulnerability (CVE-2026-118698)
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can trigger the…
PLUGIN
Joomsport Sports League Results Management
CVE-2026-118698
Risk Score
Threat Entry
Updated 2026-10-30
Content Egg - Security Vulnerability (CVE-2026-119087)
The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to create posts attributed to another user's account — typically an administrator — by supplying an admin-owned preset_id, causing wp_insert_post to record the administrator as post_author. This includes the ability to create published posts…
PLUGIN
Content Egg
CVE-2026-119087
Risk Score
Threat Entry
Updated 2026-10-30
Content Egg - Security Vulnerability (CVE-2026-119059)
The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static nonce ('contentegg_metabox') and the generic 'edit_posts' capability, but trusts the attacker-supplied $_POST['post_id'] verbatim and never calls current_user_can('edit_post', $post_id) — the per-object check that its sibling save_post handler saveMeta() correctly performs. This makes it possible for authenticated attackers, with contributor-level access and above, to modify Content Egg product data (_cegg_data_*) and update-timestamp post meta on…
PLUGIN
Content Egg
CVE-2026-119059
Risk Score
Threat Entry
Updated 2026-10-30
Firelight Lightbox - Security Vulnerability (CVE-2026-118165)
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.
PLUGIN
Firelight Lightbox
CVE-2026-118165
Risk Score
Threat Entry
Updated 2026-10-30
Page And Post Restriction - Security Vulnerability (CVE-2026-118194)
The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the current user from the `wordpress_logged_in` cookie via `wp_set_current_user()` for any GET or HEAD REST request where the current user is 0, without verifying a REST nonce — silently undoing the nonce-zeroing that WordPress core's `rest_cookie_check_errors()` performs on cookie-authenticated requests that lack an `X-WP-Nonce` header or `_wpnonce` parameter. Combined with WordPress's permissive REST CORS behavior — which echoes…
PLUGIN
Page And Post Restriction
CVE-2026-118194
Risk Score
Threat Entry
Updated 2026-10-30
Events Made Easy - Security Vulnerability (CVE-2026-118634)
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Events Made Easy
CVE-2026-118634
Risk Score
Threat Entry
Updated 2026-10-30
Extensions For Elementor Form - Security Vulnerability (CVE-2026-118500)
The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores " to a raw double-quote inside…
PLUGIN
Extensions For Elementor Form
CVE-2026-118500
Risk Score
Threat Entry
Updated 2026-10-30
WP Visitor Statistics - Security Vulnerability (CVE-2026-117571)
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a logged-in administrator views the statistics pages.
PLUGIN
WP Visitor Statistics
CVE-2026-117571
Risk Score
Threat Entry
Updated 2026-10-30
Joinchat - Security Vulnerability (CVE-2026-118071)
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.
PLUGIN
Joinchat
CVE-2026-118071
Risk Score
Threat Entry
Updated 2026-10-30
Fraud Prevention For WooCommerce and EDD - Security Vulnerability (CVE-2026-118072)
The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users with the Subscriber role and above to prevent arbitrary legitimate customers from placing orders.
PLUGIN
Fraud Prevention For WooCommerce and EDD
CVE-2026-118072
Risk Score
Threat Entry
Updated 2026-10-30
BuddyForms - Security Vulnerability (CVE-2026-118101)
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages, including those of administrators.
PLUGIN
BuddyForms
CVE-2026-118101
Risk Score
Threat Entry
Updated 2026-10-30
BuddyForms - Security Vulnerability (CVE-2026-118100)
The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.
PLUGIN
BuddyForms
CVE-2026-118100
Risk Score
Threat Entry
Updated 2026-10-30
WP Visitor Statistics - Security Vulnerability (CVE-2026-117572)
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
PLUGIN
WP Visitor Statistics
CVE-2026-117572
Risk Score
Threat Entry
Updated 2026-10-30
Security Plugin, Firewall & Malware Scanner with Auto Removal - Security Vulnerability (CVE-2026-114443)
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's current authenticator code to log in as that user, including an administrator, without the password.
PLUGIN
Security Plugin, Firewall & Malware Scanner with Auto Removal
CVE-2026-114443
Risk Score