Threat Entry Updated 2026-06-17

CVE-2026-34902 - WordPress component

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite

UNKNOWN WordPress component

CVE-2026-34902

HIGH CVSS 7.1 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-34900 - WordPress component

Unauthenticated Cross Site Scripting (XSS) in GiveWP

UNKNOWN WordPress component

CVE-2026-34900

HIGH CVSS 7.1 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-34898 - WordPress component

Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce

UNKNOWN WordPress component

CVE-2026-34898

HIGH CVSS 7.5 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-34891 - WordPress component

Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce

UNKNOWN WordPress component

CVE-2026-34891

HIGH CVSS 7.5 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-34886 - WordPress component

Unauthenticated Broken Access Control in Simple Membership

UNKNOWN WordPress component

CVE-2026-34886

HIGH CVSS 7.5 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27407 - WordPress component

Editor Privilege Escalation in AI Engine

UNKNOWN WordPress component

CVE-2026-27407

HIGH CVSS 7.2 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-34892 - WordPress component

Subscriber Broken Access Control in Rank Math SEO

UNKNOWN WordPress component

CVE-2026-34892

MEDIUM CVSS 6.5 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27053 - WordPress component

Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

UNKNOWN WordPress component

CVE-2026-27053

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-24637 - WordPress component

Contributor SQL Injection in PowerPress Podcasting

UNKNOWN WordPress component

CVE-2026-24637

HIGH CVSS 8.5 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27333 - WordPress component

Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site

UNKNOWN WordPress component

CVE-2026-27333

HIGH CVSS 8.1 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-27089 - WordPress component

Unauthenticated Bypass Vulnerability in WpTravelly

UNKNOWN WordPress component

CVE-2026-27089

HIGH CVSS 7.5 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-25425 - WordPress component

Unauthenticated Broken Access Control in User Registration

UNKNOWN WordPress component

CVE-2026-25425

HIGH CVSS 7.5 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-23970 - Contact Form 7 Plugin

Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7

PLUGIN Contact Form 7

CVE-2026-23970

HIGH CVSS 7.1 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-25440 - Elementor Plugin

Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.

PLUGIN Elementor

CVE-2026-25440

MEDIUM CVSS 5.3 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-52704 - WooCommerce PDF Invoice Builder Plugin

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

PLUGIN WooCommerce PDF Invoice Builder

CVE-2026-52704

CRITICAL CVSS 10.0 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49111 - Masteriyo - LMS Plugin

Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2.2.0.

PLUGIN Masteriyo - LMS

CVE-2026-49111

HIGH CVSS 8.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49062 - Faust.Js Plugin

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7.

PLUGIN Faust.Js

CVE-2026-49062

HIGH CVSS 8.8 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-49064 - GetPaid Plugin

Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.

PLUGIN GetPaid

CVE-2026-49064

HIGH CVSS 7.5 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-48969 - WordPress component

Subscriber Broken Access Control in Really Simple SSL

UNKNOWN WordPress component

CVE-2026-48969

MEDIUM CVSS 6.5 2026-06-15

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-8935 - Wp Maps Pro Plugin

The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access.

PLUGIN Wp Maps Pro

CVE-2026-8935

CRITICAL CVSS 9.8 2026-06-15

Risk Score

Open Full Technical Breakdown