Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-26
Ad Inserter - Security Vulnerability (CVE-2026-114194)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
PLUGIN
Ad Inserter
CVE-2026-114194
Risk Score
Threat Entry
Updated 2026-10-26
Newsletters Lite - Security Vulnerability (CVE-2026-94075)
Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1.
PLUGIN
Newsletters Lite
CVE-2026-94075
Risk Score
Threat Entry
Updated 2026-10-26
Qa Heatmap Analytics - Security Vulnerability (CVE-2026-114697)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.
PLUGIN
Qa Heatmap Analytics
CVE-2026-114697
Risk Score
Threat Entry
Updated 2026-10-26
Vod Infomaniak - Security Vulnerability (CVE-2026-114695)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.
PLUGIN
Vod Infomaniak
CVE-2026-114695
Risk Score
Threat Entry
Updated 2026-10-26
Events Manager - Security Vulnerability (CVE-2026-114694)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.
PLUGIN
Events Manager
CVE-2026-114694
Risk Score
Threat Entry
Updated 2026-10-26
All In One Video Gallery - Security Vulnerability (CVE-2026-114693)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 4.9.7.
PLUGIN
All In One Video Gallery
CVE-2026-114693
Risk Score
Threat Entry
Updated 2026-10-26
Paytium - Security Vulnerability (CVE-2026-114196)
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
PLUGIN
Paytium
CVE-2026-114196
Risk Score
Threat Entry
Updated 2026-10-26
Woo Product Filter - Security Vulnerability (CVE-2026-112866)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL Injection.This issue affects Product Filter by WBW: from n/a through 3.4.6.
PLUGIN
Woo Product Filter
CVE-2026-112866
Risk Score
Threat Entry
Updated 2026-10-26
Bp Better Messages - Security Vulnerability (CVE-2026-114179)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.
PLUGIN
Bp Better Messages
CVE-2026-114179
Risk Score
Threat Entry
Updated 2026-10-26
W3 Total Cache - Security Vulnerability (CVE-2026-114178)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.
PLUGIN
W3 Total Cache
CVE-2026-114178
Risk Score
Threat Entry
Updated 2026-10-26
Opening Hours - Security Vulnerability (CVE-2026-112869)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.
PLUGIN
Opening Hours
CVE-2026-112869
Risk Score
Threat Entry
Updated 2026-10-26
Wp Event Solution - Security Vulnerability (CVE-2026-112844)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.
PLUGIN
Wp Event Solution
CVE-2026-112844
Risk Score
Threat Entry
Updated 2026-10-26
Litespeed Cache - Security Vulnerability (CVE-2026-114190)
Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.
PLUGIN
Litespeed Cache
CVE-2026-114190
Risk Score
Threat Entry
Updated 2026-10-26
Newsletters Lite - Security Vulnerability (CVE-2026-111402)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.
PLUGIN
Newsletters Lite
CVE-2026-111402
Risk Score
Threat Entry
Updated 2026-10-26
Suredash - Security Vulnerability (CVE-2026-110892)
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
PLUGIN
Suredash
CVE-2026-110892
Risk Score
Threat Entry
Updated 2026-10-26
WPVR - Security Vulnerability (CVE-2026-114429)
The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.
PLUGIN
WPVR
CVE-2026-114429
Risk Score
Threat Entry
Updated 2026-10-26
Front End Users - Security Vulnerability (CVE-2026-87835)
The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.
PLUGIN
Front End Users
CVE-2026-87835
Risk Score
Threat Entry
Updated 2026-10-26
News Kit Addons For Elementor - Security Vulnerability (CVE-2026-97353)
The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions, allowing users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users. This can be used to overwrite protected core metadata and tamper with content created by higher-privileged users.
PLUGIN
News Kit Addons For Elementor
CVE-2026-97353
Risk Score
Threat Entry
Updated 2026-10-26
News Kit Addons For Elementor - Security Vulnerability (CVE-2026-97352)
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.
PLUGIN
News Kit Addons For Elementor
CVE-2026-97352
Risk Score
Threat Entry
Updated 2026-10-26
GeoDirectory - Security Vulnerability (CVE-2026-113674)
The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.
PLUGIN
GeoDirectory
CVE-2026-113674
Risk Score