Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-26
asVereinbase - Security Vulnerability (CVE-2026-110956)
The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator.
PLUGIN
asVereinbase
CVE-2026-110956
Risk Score
Threat Entry
Updated 2026-10-26
GeoDirectory - Security Vulnerability (CVE-2026-113673)
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.
PLUGIN
GeoDirectory
CVE-2026-113673
Risk Score
Threat Entry
Updated 2026-10-26
Download Monitor - Security Vulnerability (CVE-2026-112207)
The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.
PLUGIN
Download Monitor
CVE-2026-112207
Risk Score
Threat Entry
Updated 2026-10-26
GeoDirectory - Security Vulnerability (CVE-2026-113493)
The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.
PLUGIN
GeoDirectory
CVE-2026-113493
Risk Score
Threat Entry
Updated 2026-10-26
GeoDirectory - Security Vulnerability (CVE-2026-113491)
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension. A disclosed file is re-published at a public URL and its original is deleted as a side effect.
PLUGIN
GeoDirectory
CVE-2026-113491
Risk Score
Threat Entry
Updated 2026-10-26
GeoDirectory - Security Vulnerability (CVE-2026-113492)
The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.
PLUGIN
GeoDirectory
CVE-2026-113492
Risk Score
Threat Entry
Updated 2026-10-26
GeoDirectory - Security Vulnerability (CVE-2026-113490)
The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
PLUGIN
GeoDirectory
CVE-2026-113490
Risk Score
Threat Entry
Updated 2026-10-26
GeoDirectory - Security Vulnerability (CVE-2026-113489)
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.
PLUGIN
GeoDirectory
CVE-2026-113489
Risk Score
Threat Entry
Updated 2026-10-26
MAS Videos - Security Vulnerability (CVE-2026-107907)
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.
PLUGIN
MAS Videos
CVE-2026-107907
Risk Score
Threat Entry
Updated 2026-10-26
Advanced Twenty Seventeen - Security Vulnerability (CVE-2026-107887)
The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child , allowing any authenticated user such as a subscriber to switch the site's active site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.
PLUGIN
Advanced Twenty Seventeen
CVE-2026-107887
Risk Score
Threat Entry
Updated 2026-10-26
Pixel Tag Manager for WooCommerce - Security Vulnerability (CVE-2026-105199)
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.
PLUGIN
Pixel Tag Manager for WooCommerce
CVE-2026-105199
Risk Score
Threat Entry
Updated 2026-10-29
Profile Builder - Security Vulnerability (CVE-2026-115807)
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with…
PLUGIN
Profile Builder
CVE-2026-115807
Risk Score
Threat Entry
Updated 2026-10-29
Prime Mover - Security Vulnerability (CVE-2026-115806)
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint (wp-comments-post.php). When an administrator subsequently performs a routine Prime Mover export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's…
PLUGIN
Prime Mover
CVE-2026-115806
Risk Score
Threat Entry
Updated 2026-10-29
gtm-server-side-wordpress-plugin - Security Vulnerability (CVE-2026-55826)
The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
PLUGIN
gtm-server-side-wordpress-plugin
CVE-2026-55826
Risk Score
Threat Entry
Updated 2026-10-24
Little Birdies - Security Vulnerability (CVE-2026-112859)
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
THEME
Little Birdies
CVE-2026-112859
Risk Score
Threat Entry
Updated 2026-10-24
Rhodos - Security Vulnerability (CVE-2026-112858)
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
THEME
Rhodos
CVE-2026-112858
Risk Score
Threat Entry
Updated 2026-10-23
Reprizo - Security Vulnerability (CVE-2026-112857)
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
THEME
Reprizo
CVE-2026-112857
Risk Score
Threat Entry
Updated 2026-10-24
Vagabonds - Security Vulnerability (CVE-2026-112856)
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
THEME
Vagabonds
CVE-2026-112856
Risk Score
Threat Entry
Updated 2026-10-24
Redy - Security Vulnerability (CVE-2026-112855)
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
THEME
Redy
CVE-2026-112855
Risk Score
Threat Entry
Updated 2026-10-24
Holistic Center - Security Vulnerability (CVE-2026-112854)
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
THEME
Holistic Center
CVE-2026-112854
Risk Score