Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-02
Product Sets Plugin - Security Vulnerability (CVE-2026-116107)
A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by this issue is the function dfrps_ajax_delete_saved_search of the file functions/ajax.php of the component AJAX Handlers. The manipulation results in missing authorization. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
PLUGIN
Product Sets Plugin
CVE-2026-116107
Risk Score
Threat Entry
Updated 2026-10-26
Chikkili- Google Pay India for Woocommerce - Security Vulnerability (CVE-2026-94295)
The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without any payment being made.
PLUGIN
Chikkili- Google Pay India for Woocommerce
CVE-2026-94295
Risk Score
Threat Entry
Updated 2026-10-26
Datawiza Proxy Auth Plugin - Security Vulnerability (CVE-2026-115214)
The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.
PLUGIN
Datawiza Proxy Auth Plugin
CVE-2026-115214
Risk Score
Threat Entry
Updated 2026-10-26
efore 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator - Security Vulnerability (CVE-2026-115251)
The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.
PLUGIN
efore 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator
CVE-2026-115251
Risk Score
Threat Entry
Updated 2026-10-26
InstaWP Connect - Security Vulnerability (CVE-2026-114743)
The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect WordPress plugin before 0.1.4.2's sync feature to overwrite the InstaWP Connect WordPress plugin before 0.1.4.2's settings, including the setting controlling which roles may access that feature. The role grant is not enabled by default.
PLUGIN
InstaWP Connect
CVE-2026-114743
Risk Score
Threat Entry
Updated 2026-10-26
Qi Addons For Elementor - Security Vulnerability (CVE-2026-115183)
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would otherwise strip them.
PLUGIN
Qi Addons For Elementor
CVE-2026-115183
Risk Score
Threat Entry
Updated 2026-10-26
on form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP - Security Vulnerability (CVE-2026-111979)
The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.
PLUGIN
on form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP
CVE-2026-111979
Risk Score
Threat Entry
Updated 2026-10-26
to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP - Security Vulnerability (CVE-2026-111978)
The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.
PLUGIN
to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP
CVE-2026-111978
Risk Score
Threat Entry
Updated 2026-10-26
GiveWP - Security Vulnerability (CVE-2026-111980)
The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.
PLUGIN
GiveWP
CVE-2026-111980
Risk Score
Threat Entry
Updated 2026-10-26
GiveWP - Security Vulnerability (CVE-2026-111976)
The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.
PLUGIN
GiveWP
CVE-2026-111976
Risk Score
Threat Entry
Updated 2026-10-26
WP Stripe Checkout - Security Vulnerability (CVE-2026-110285)
The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order without paying.
PLUGIN
WP Stripe Checkout
CVE-2026-110285
Risk Score
Threat Entry
Updated 2026-10-26
WPVR - Security Vulnerability (CVE-2026-114740)
The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create or publish.
PLUGIN
WPVR
CVE-2026-114740
Risk Score
Threat Entry
Updated 2026-10-26
WPVR - Security Vulnerability (CVE-2026-114741)
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
PLUGIN
WPVR
CVE-2026-114741
Risk Score
Threat Entry
Updated 2026-10-26
WPVR - Security Vulnerability (CVE-2026-114742)
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
PLUGIN
WPVR
CVE-2026-114742
Risk Score
Threat Entry
Updated 2026-10-26
GiveWP - Security Vulnerability (CVE-2026-111981)
The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.
PLUGIN
GiveWP
CVE-2026-111981
Risk Score
Threat Entry
Updated 2026-10-26
Relevanssi - Security Vulnerability (CVE-2026-114704)
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
PLUGIN
Relevanssi
CVE-2026-114704
Risk Score
Threat Entry
Updated 2026-10-26
Mage Eventpress - Security Vulnerability (CVE-2026-114192)
Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.
PLUGIN
Mage Eventpress
CVE-2026-114192
Risk Score
Threat Entry
Updated 2026-10-26
Upi Qr Code Payment For Woocommerce - Security Vulnerability (CVE-2026-114191)
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.
PLUGIN
Upi Qr Code Payment For Woocommerce
CVE-2026-114191
Risk Score
Threat Entry
Updated 2026-10-26
Ablocks - Security Vulnerability (CVE-2026-110018)
The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because the endpoint is registered with `permission_callback => __return_true` and the `register()` handler reads `roleSlug` directly from attacker-controlled block attributes in `post_content` without ever verifying that the block's `formType` is `registration` — a condition that `RegistrationFormSanitizer::verify()` imposes only at save-time, meaning a Contributor can preserve an arbitrary `roleSlug` by saving a…
PLUGIN
Ablocks
CVE-2026-110018
Risk Score
Threat Entry
Updated 2026-10-26
Insta Gallery - Security Vulnerability (CVE-2026-114705)
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.
PLUGIN
Insta Gallery
CVE-2026-114705
Risk Score