Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-10
Foosales - Security Vulnerability (CVE-2026-77183)
The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with FooSales Cashier-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.
PLUGIN
Foosales
CVE-2026-77183
Risk Score
Threat Entry
Updated 2026-10-10
LTL Freight Quotes - Security Vulnerability (CVE-2026-87781)
The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
PLUGIN
LTL Freight Quotes
CVE-2026-87781
Risk Score
Threat Entry
Updated 2026-10-10
Tutor LMS - Security Vulnerability (CVE-2026-85571)
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.
PLUGIN
Tutor LMS
CVE-2026-85571
Risk Score
Threat Entry
Updated 2026-10-11
Table Field Add-on for ACF and SCF - Security Vulnerability (CVE-2026-78068)
The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell Content in all versions up to, and including, 1.3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Table Field Add-on for ACF and SCF
CVE-2026-78068
Risk Score
Threat Entry
Updated 2026-10-10
Appointment Booking Plugin - Security Vulnerability (CVE-2026-91050)
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps__start and steps__load_step routes accepting a params[presets][order_item_id] value that is copied verbatim into the booking object without verifying that the referenced order item belongs to the current customer, is a bundle item, is paid, or has remaining capacity — the is_bundle_scheduling() bundle discriminator is a mere !empty(order_item_id) truthiness check, and the…
PLUGIN
Appointment Booking Plugin
CVE-2026-91050
Risk Score
Threat Entry
Updated 2026-10-11
Embed Any Document - Security Vulnerability (CVE-2026-18558)
The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode in all versions up to, and including, 2.7.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Embed Any Document
CVE-2026-18558
Risk Score
Threat Entry
Updated 2026-10-11
Graphene - Security Vulnerability (CVE-2026-17025)
The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versions up to, and including, 2.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
THEME
Graphene
CVE-2026-17025
Risk Score
Threat Entry
Updated 2026-10-11
Mp3 Music Player By Sonaar - Security Vulnerability (CVE-2026-16776)
The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.14.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress's save-time wp_kses_post does not neutralize the payload because the attack is delivered via shortcode attributes rather than raw HTML…
PLUGIN
Mp3 Music Player By Sonaar
CVE-2026-16776
Risk Score
Threat Entry
Updated 2026-10-10
Booking Calendar - Security Vulnerability (CVE-2026-18496)
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_popover_in_flex_timeline() function. This makes it possible for unauthenticated attackers to extract sensitive data including names, email addresses, and phone numbers of customers who have made bookings.
PLUGIN
Booking Calendar
CVE-2026-18496
Risk Score
Threat Entry
Updated 2026-10-11
Easy Digital Downloads - Security Vulnerability (CVE-2026-14335)
The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PayPal IPN Parameters in all versions up to, and including, 3.6.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Easy Digital Downloads
CVE-2026-14335
Risk Score
Threat Entry
Updated 2026-10-10
Gallery PhotoBlocks - Security Vulnerability (CVE-2026-107323)
The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.
PLUGIN
Gallery PhotoBlocks
CVE-2026-107323
Risk Score
Threat Entry
Updated 2026-10-11
Brizy - Page Builder - Security Vulnerability (CVE-2026-14882)
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Brizy - Page Builder
CVE-2026-14882
Risk Score
Threat Entry
Updated 2026-10-11
Data Tables Generator By Supsystic - Security Vulnerability (CVE-2026-14877)
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Data Tables Generator By Supsystic
CVE-2026-14877
Risk Score
Threat Entry
Updated 2026-10-11
Gamipress - Security Vulnerability (CVE-2026-14379)
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'video_id' parameter in all versions up to, and including, 7.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Gamipress
CVE-2026-14379
Risk Score
Threat Entry
Updated 2026-10-11
Download Manager - Security Vulnerability (CVE-2026-12054)
The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'REFERRER' parameter in all versions up to, and including, 3.3.57 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
PLUGIN
Download Manager
CVE-2026-12054
Risk Score
Threat Entry
Updated 2026-10-10
W3 Total Cache - Security Vulnerability (CVE-2026-107321)
The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.
PLUGIN
W3 Total Cache
CVE-2026-107321
Risk Score
Threat Entry
Updated 2026-10-10
Appointment Booking Plugin - Security Vulnerability (CVE-2026-104766)
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over attacker-supplied `settings` parameters without an allowlist of permitted setting names or values, and `OsSettingsHelper::prepare_value()` performing no role allowlist validation before persisting the `default_wp_role_for_customer` setting — a restriction that exists only in the UI dropdown and is never enforced server-side. This makes it possible for authenticated attackers holding a LatePoint role with the `settings__edit`…
PLUGIN
Appointment Booking Plugin
CVE-2026-104766
Risk Score
Threat Entry
Updated 2026-10-10
Geodirectory - Security Vulnerability (CVE-2026-104899)
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The required nonce is…
PLUGIN
Geodirectory
CVE-2026-104899
Risk Score
Threat Entry
Updated 2026-10-10
Contest Gallery - Security Vulnerability (CVE-2026-107120)
The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verification step, which relies on a short numeric PIN, allowing unauthenticated attackers to brute-force the PIN and create and activate a WordPress account bound to an email address they do not own, gaining an authenticated session.
PLUGIN
Contest Gallery
CVE-2026-107120
Risk Score
Threat Entry
Updated 2026-10-10
Booking Package - Security Vulnerability (CVE-2026-105995)
The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.
PLUGIN
Booking Package
CVE-2026-105995
Risk Score