Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-10
Accept PayPal Payments using Contact Form 7 - Security Vulnerability (CVE-2026-105990)
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.
PLUGIN
Accept PayPal Payments using Contact Form 7
CVE-2026-105990
Risk Score
Threat Entry
Updated 2026-10-10
Accept PayPal Payments using Contact Form 7 - Security Vulnerability (CVE-2026-105989)
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.
PLUGIN
Accept PayPal Payments using Contact Form 7
CVE-2026-105989
Risk Score
Threat Entry
Updated 2026-10-10
Portfolio Filter Gallery - Security Vulnerability (CVE-2026-105976)
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing users with at least the Contributor role to read, modify and delete other users' galleries as well as site-wide gallery filters.
PLUGIN
Portfolio Filter Gallery
CVE-2026-105976
Risk Score
Threat Entry
Updated 2026-10-10
Portfolio Filter Gallery - Security Vulnerability (CVE-2026-105977)
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other users, including administrators.
PLUGIN
Portfolio Filter Gallery
CVE-2026-105977
Risk Score
Threat Entry
Updated 2026-10-10
Rank Math SEO - Security Vulnerability (CVE-2026-104752)
The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution.
PLUGIN
Rank Math SEO
CVE-2026-104752
Risk Score
Threat Entry
Updated 2026-10-11
Kadence Blocks - Security Vulnerability (CVE-2026-104762)
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This encoding bypass is only triggered when the "Load Google Fonts Locally" site option (kadence_blocks_font_settings['load_fonts_local']) is enabled, which is not the…
PLUGIN
Kadence Blocks
CVE-2026-104762
Risk Score
Threat Entry
Updated 2026-10-10
Post Export Import With Media - Security Vulnerability (CVE-2026-104763)
The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension…
PLUGIN
Post Export Import With Media
CVE-2026-104763
Risk Score
Threat Entry
Updated 2026-10-10
Rank Math SEO - Security Vulnerability (CVE-2026-104753)
The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing high-privilege users such as administrators to perform SQL injection attacks.
PLUGIN
Rank Math SEO
CVE-2026-104753
Risk Score
Threat Entry
Updated 2026-10-10
Rank Math SEO - Security Vulnerability (CVE-2026-104754)
The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.
PLUGIN
Rank Math SEO
CVE-2026-104754
Risk Score
Threat Entry
Updated 2026-10-10
Gpt3 Ai Content Generator - Security Vulnerability (CVE-2026-104742)
The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global site-wide semantic search settings, including vector provider, embedding provider, embedding model, target ID, number of results, and no-results text stored in aipkit_options, that are otherwise restricted to administrators. Exploitation requires that…
PLUGIN
Gpt3 Ai Content Generator
CVE-2026-104742
Risk Score
Threat Entry
Updated 2026-10-10
Gpt3 Ai Content Generator - Security Vulnerability (CVE-2026-104741)
The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.4.89. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify global plugin indexing and vector-search configuration options (aipkit_training_general_settings and aipkit_indexing_field_settings), including chunking parameters, file upload visibility, and per-CPT field indexing settings, affecting all users of the plugin. This is only exploitable in…
PLUGIN
Gpt3 Ai Content Generator
CVE-2026-104741
Risk Score
Threat Entry
Updated 2026-10-10
Groundhogg - Security Vulnerability (CVE-2026-104725)
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.9 This is due to a missing ownership and capability check on the `user` parameter within the `process_edit()` function, which allows any authenticated user with the `edit_contacts` capability to reassign a contact record's linked WordPress user ID to any arbitrary account without requiring the `edit_users` or `promote_users` capabilities. This makes it possible for authenticated attackers, with sales_rep-level access and above, to escalate their privileges to administrator by…
PLUGIN
Groundhogg
CVE-2026-104725
Risk Score
Threat Entry
Updated 2026-10-10
Lifterlms - Security Vulnerability (CVE-2026-104723)
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an…
PLUGIN
Lifterlms
CVE-2026-104723
Risk Score
Threat Entry
Updated 2026-10-10
Hivepress - Security Vulnerability (CVE-2026-103520)
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the…
PLUGIN
Hivepress
CVE-2026-103520
Risk Score
Threat Entry
Updated 2026-10-10
Popup By Supsystic - Security Vulnerability (CVE-2026-104023)
The Smart Popup by Supsystic plugin for WordPress is vulnerable to generic SQL Injection via the 'sidx' parameter in all versions up to, and including, 1.13.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Popup By Supsystic
CVE-2026-104023
Risk Score
Threat Entry
Updated 2026-10-11
Jetformbuilder - Security Vulnerability (CVE-2026-103912)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '
PLUGIN
Jetformbuilder
CVE-2026-103912
Risk Score
Threat Entry
Updated 2026-10-11
Newsletter Optin Box - Security Vulnerability (CVE-2026-103482)
The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptin_fields[] (e.g. first_name)' parameter in all versions up to, and including, 4.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack chain requires a published campaign post whose body contains a [[subscriber.*]] merge tag; the unauthenticated attacker first POSTs the entity-encoded payload to the public manage_preferences form (which…
PLUGIN
Newsletter Optin Box
CVE-2026-103482
Risk Score
Threat Entry
Updated 2026-10-10
Avada (Fusion) Builder - Security Vulnerability (CVE-2026-97670)
The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data token; the 3.16.1 trust gate is_content_request_supplied() only inspects $_POST['args']/$_GET['args'], never the $_POST['formData'] the public form-submit endpoint parses). This makes it possible for unauthenticated attackers to invoke arbitrary WordPress action hooks (multiple per request), causing state…
PLUGIN
Avada (Fusion) Builder
CVE-2026-97670
Risk Score
Threat Entry
Updated 2026-10-10
Buddypress Media - Security Vulnerability (CVE-2026-89301)
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe files on the server.. The public nonce (rtmedia_upload_nonce) is emitted into frontend JavaScript on any page rendering the rtMedia gallery or upload shortcode, making it retrievable by unauthenticated visitors without any prior authentication or privileged action.
PLUGIN
Buddypress Media
CVE-2026-89301
Risk Score
Threat Entry
Updated 2026-10-11
Fv Wordpress Flowplayer - Security Vulnerability (CVE-2026-97630)
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and including, 7.5.54.7212 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the profile_videos_enable_bio option to be enabled, as script execution occurs on the author bio/archive page where the profile-video shortcode is rendered.
PLUGIN
Fv Wordpress Flowplayer
CVE-2026-97630
Risk Score