Threat Entry Updated 2026-06-17

CVE-2026-8089 - Email Optins For Woocommerce Plugin

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.

PLUGIN Email Optins For Woocommerce

CVE-2026-8089

HIGH CVSS 7.1 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-7850 - Wp Magnific Popup Plugin

The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks against any visiting user.

PLUGIN Wp Magnific Popup

CVE-2026-7850

MEDIUM CVSS 5.9 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54807 - WordPress component

Unauthenticated Privilege Escalation in Registration Form for WooCommerce

UNKNOWN WordPress component

CVE-2026-54807

CRITICAL CVSS 9.8 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54806 - WordPress component

Unauthenticated PHP Object Injection in WP Activity Log

UNKNOWN WordPress component

CVE-2026-54806

CRITICAL CVSS 9.8 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54803 - WordPress component

Subscriber Privilege Escalation in SMS Alert Order Notifications

UNKNOWN WordPress component

CVE-2026-54803

CRITICAL CVSS 9.8 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54811 - WordPress component

Unauthenticated SQL Injection in WP eMember < v10.9.4 versions.

UNKNOWN WordPress component

CVE-2026-54811

CRITICAL CVSS 9.3 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54805 - WordPress component

Subscriber Privilege Escalation in Falang multilanguage

UNKNOWN WordPress component

CVE-2026-54805

HIGH CVSS 8.8 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54804 - WordPress component

Subscriber Broken Authentication in Melhor Envio

UNKNOWN WordPress component

CVE-2026-54804

HIGH CVSS 7.6 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54802 - WordPress component

Unauthenticated Broken Authentication in SMS Alert Order Notifications

UNKNOWN WordPress component

CVE-2026-54802

HIGH CVSS 7.5 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54194 - WordPress component

Contributor PHP Object Injection in Fusion Builder

UNKNOWN WordPress component

CVE-2026-54194

CRITICAL CVSS 9.8 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54187 - WordPress component

Unauthenticated SQL Injection in JetEngine

UNKNOWN WordPress component

CVE-2026-54187

CRITICAL CVSS 9.3 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54195 - WordPress component

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder

UNKNOWN WordPress component

CVE-2026-54195

HIGH CVSS 7.1 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54192 - WordPress component

Unauthenticated Cross Site Scripting (XSS) in Popup box

UNKNOWN WordPress component

CVE-2026-54192

HIGH CVSS 7.1 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54189 - WordPress component

Unauthenticated Cross Site Scripting (XSS) in JetEngine

UNKNOWN WordPress component

CVE-2026-54189

HIGH CVSS 7.1 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54188 - WordPress component

Unauthenticated Cross Site Scripting (XSS) in JetEngine

UNKNOWN WordPress component

CVE-2026-54188

HIGH CVSS 7.1 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54196 - WordPress component

Subscriber Privilege Escalation in JetFormBuilder

UNKNOWN WordPress component

CVE-2026-54196

MEDIUM CVSS 6.8 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-52706 - WordPress component

Unauthenticated PHP Object Injection in JetEngine

UNKNOWN WordPress component

CVE-2026-52706

CRITICAL CVSS 9.8 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54186 - WordPress component

Unauthenticated SQL Injection in JobSearch

UNKNOWN WordPress component

CVE-2026-54186

CRITICAL CVSS 9.3 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-52705 - WordPress component

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms

UNKNOWN WordPress component

CVE-2026-52705

CRITICAL CVSS 9.0 2026-06-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-54185 - WordPress component

Subscriber SQL Injection in Cornerstone < 7.8.8 versions.

UNKNOWN WordPress component

CVE-2026-54185

HIGH CVSS 8.5 2026-06-17

Risk Score

Open Full Technical Breakdown