Threat Entry Updated 2026-02-04

CVE-2025-15285 - Lupsonline Link Netwerk Plugin

The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentication() and checkCategoryAuthentication() functions in all versions up to, and including, 2.2.1. These authorization functions only implement basic API key authentication but fail to implement WordPress capability checks. This makes it possible for unauthenticated attackers to create, modify, and delete blog posts and categories.

PLUGIN Lupsonline Link Netwerk

CVE-2025-15285

HIGH CVSS 7.5 2026-02-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-04

CVE-2025-15268 - Infility Global Plugin

The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and including, 2.14.46. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append - with certain server configurations - additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PLUGIN Infility Global

CVE-2025-15268

HIGH CVSS 7.5 2026-02-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-04

CVE-2025-15260 - Loyalty Points And Rewards For Woocommerce Plugin

The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'ajax' function. This makes it possible for authenticated attackers, with subscriber level access and above, to modify, add, or delete loyalty program earning rules, including manipulating point multipliers to arbitrary values.

PLUGIN Loyalty Points And Rewards For Woocommerce

CVE-2025-15260

MEDIUM CVSS 6.5 2026-02-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-04

CVE-2025-14461 - Woo Xendit Virtual Accounts Plugin

The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the plugin exposing a publicly accessible WooCommerce API callback endpoint (`wc_xendit_callback`) that processes payment callbacks without any authentication or cryptographic verification that the requests originate from Xendit's payment gateway. This makes it possible for unauthenticated attackers to mark any WooCommerce order as paid by sending a crafted POST request to the callback URL with a JSON body containing an `external_id` matching the order ID pattern…

PLUGIN Woo Xendit Virtual Accounts

CVE-2025-14461

MEDIUM CVSS 5.3 2026-02-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-15

CVE-2026-1756 - Wp Foft Loader Plugin

The WP FOFT Loader plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'WP_FOFT_Loader_Mimes::file_and_ext' function in all versions up to, and including, 2.1.39. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

PLUGIN Wp Foft Loader

CVE-2026-1756

HIGH CVSS 8.8 2026-02-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-15

CVE-2026-1755 - Menu Icons by ThemeIsle

The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_wp_attachment_image_alt’ post meta in all versions up to, and including, 0.13.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

THEME Menu Icons by ThemeIsle

CVE-2026-1755

MEDIUM CVSS 6.4 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-04

CVE-2026-25027 - Unicamp Plugin

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through

PLUGIN Unicamp

CVE-2026-25027

HIGH CVSS 7.5 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-12

CVE-2026-25036 - Passster Plugin

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through

PLUGIN Passster

CVE-2026-25036

MEDIUM CVSS 6.5 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-05

CVE-2026-25028 - Elementor Plugin

Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through

PLUGIN Elementor

CVE-2026-25028

MEDIUM CVSS 5.4 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25022 - KiviCare Plugin

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through

PLUGIN KiviCare

CVE-2026-25022

HIGH CVSS 8.5 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25024 - ThirstyAffiliates Plugin

Cross-Site Request Forgery (CSRF) vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Cross Site Request Forgery.This issue affects ThirstyAffiliates: from n/a through

PLUGIN ThirstyAffiliates

CVE-2026-25024

MEDIUM CVSS 5.4 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25021 - Mizan Demo Importer Plugin

Missing Authorization vulnerability in Mizan Themes Mizan Demo Importer mizan-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mizan Demo Importer: from n/a through

PLUGIN Mizan Demo Importer

CVE-2026-25021

MEDIUM CVSS 5.4 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25023 - Run Contests, Raffles, and Giveaways with ContestsWP Plugin

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker allows Retrieve Embedded Sensitive Data.This issue affects Run Contests, Raffles, and Giveaways with ContestsWP: from n/a through

PLUGIN Run Contests, Raffles, and Giveaways with ContestsWP

CVE-2026-25023

MEDIUM CVSS 5.3 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25019 - Atarim Plugin

Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through

PLUGIN Atarim

CVE-2026-25019

MEDIUM CVSS 5.3 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25020 - WP Sync for Notion Plugin

Missing Authorization vulnerability in WP connect WP Sync for Notion wp-sync-for-notion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sync for Notion: from n/a through

PLUGIN WP Sync for Notion

CVE-2026-25020

MEDIUM CVSS 4.3 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25012 - WP Bannerize Pro Plugin

Missing Authorization vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bannerize Pro: from n/a through

PLUGIN WP Bannerize Pro

CVE-2026-25012

MEDIUM CVSS 5.3 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25010 - Share This Image Plugin

Missing Authorization vulnerability in ILLID Share This Image share-this-image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share This Image: from n/a through

PLUGIN Share This Image

CVE-2026-25010

MEDIUM CVSS 5.3 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-15

CVE-2026-24998 - Hustle Plugin

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popup allows Retrieve Embedded Sensitive Data.This issue affects Hustle: from n/a through

PLUGIN Hustle

CVE-2026-24998

MEDIUM CVSS 5.3 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25016 - Nelio Popups Plugin

Missing Authorization vulnerability in Nelio Software Nelio Popups nelio-popups allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Popups: from n/a through

PLUGIN Nelio Popups

CVE-2026-25016

MEDIUM CVSS 4.3 2026-02-03

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-03

CVE-2026-25015 - UsersWP Plugin

Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through

PLUGIN UsersWP

CVE-2026-25015

MEDIUM CVSS 4.3 2026-02-03

Risk Score

Open Full Technical Breakdown