Threat Database

Threat Entry Updated 2026-10-11

Stargaze - Security Vulnerability (CVE-2026-62051)

Unauthenticated PHP Object Injection in Stargaze

THEME Stargaze

CVE-2026-62051

CRITICAL CVSS 9.8 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Splendour - Security Vulnerability (CVE-2026-62050)

Unauthenticated PHP Object Injection in Splendour

THEME Splendour

CVE-2026-62050

CRITICAL CVSS 9.8 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Contact Form 7 Dynamic Text Extension - Security Vulnerability (CVE-2026-62043)

Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension

PLUGIN Contact Form 7 Dynamic Text Extension

CVE-2026-62043

HIGH CVSS 7.5 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Eroom Zoom Meetings Webinar - Security Vulnerability (CVE-2026-62038)

Unauthenticated Broken Authentication in eRoom

PLUGIN Eroom Zoom Meetings Webinar

CVE-2026-62038

HIGH CVSS 7.3 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Ambed - Security Vulnerability (CVE-2026-62064)

Unauthenticated Cross Site Scripting (XSS) in Ambed

THEME Ambed

CVE-2026-62064

HIGH CVSS 7.1 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-11-07

Directorypress - Security Vulnerability (CVE-2026-62032)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Designinvento DirectoryPress directorypress allows PHP Local File Inclusion.This issue affects DirectoryPress: from n/a through 3.6.27.

PLUGIN Directorypress

CVE-2026-62032

CRITICAL CVSS 9.8 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-11-14

Ulisting - Security Vulnerability (CVE-2026-62031)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes uListing ulisting allows Blind SQL Injection.This issue affects uListing: from n/a through 2.2.0.

PLUGIN Ulisting

CVE-2026-62031

CRITICAL CVSS 9.3 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Ulisting - Security Vulnerability (CVE-2026-62033)

Subscriber Settings Change in uListing

PLUGIN Ulisting

CVE-2026-62033

HIGH CVSS 7.6 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Streamcast - Security Vulnerability (CVE-2026-62030)

Unauthenticated Server Side Request Forgery (SSRF) in StreamCast

PLUGIN Streamcast

CVE-2026-62030

HIGH CVSS 7.2 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Document Emberdder - Security Vulnerability (CVE-2026-62037)

Unauthenticated Cross Site Scripting (XSS) in Document Embedder

PLUGIN Document Emberdder

CVE-2026-62037

HIGH CVSS 7.1 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Before After Image Compare - Security Vulnerability (CVE-2026-62034)

Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP

PLUGIN Before After Image Compare

CVE-2026-62034

HIGH CVSS 7.1 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Upcasted S3 Offload - Security Vulnerability (CVE-2026-62035)

Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted

PLUGIN Upcasted S3 Offload

CVE-2026-62035

MEDIUM CVSS 6.3 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Codebard Help Desk - Security Vulnerability (CVE-2026-62024)

Subscriber Arbitrary File Upload in CodeBard Help Desk

PLUGIN Codebard Help Desk

CVE-2026-62024

CRITICAL CVSS 9.9 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Tonda Membership - Security Vulnerability (CVE-2026-62022)

Unauthenticated Privilege Escalation in Tonda Membership

PLUGIN Tonda Membership

CVE-2026-62022

CRITICAL CVSS 9.8 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Tailored Tools - Security Vulnerability (CVE-2026-62025)

Unauthenticated Arbitrary File Upload in Tailored Tools

PLUGIN Tailored Tools

CVE-2026-62025

CRITICAL CVSS 9.0 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Angio - Security Vulnerability (CVE-2026-62021)

Subscriber PHP Object Injection in Angio

THEME Angio

CVE-2026-62021

HIGH CVSS 8.8 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Touchup - Security Vulnerability (CVE-2026-62020)

Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

THEME Touchup

CVE-2026-62020

HIGH CVSS 8.1 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Dukamarket - Security Vulnerability (CVE-2026-48194)

Unauthenticated Local File Inclusion in DukaMarket

THEME Dukamarket

CVE-2026-48194

HIGH CVSS 8.1 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Team Section - Security Vulnerability (CVE-2026-62027)

Unauthenticated Cross Site Scripting (XSS) in Team Section Block

PLUGIN Team Section

CVE-2026-62027

HIGH CVSS 7.1 2026-10-10

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-11

Kidsplanet - Security Vulnerability (CVE-2026-57742)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

THEME Kidsplanet

CVE-2026-57742

HIGH CVSS 7.1 2026-10-10

Risk Score

Open Full Technical Breakdown