Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
Translatepress Multilingual - Security Vulnerability (CVE-2026-121765)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.8.
PLUGIN
Translatepress Multilingual
CVE-2026-121765
Risk Score
Threat Entry
Updated 2026-11-07
Wp Imageviewer - Security Vulnerability (CVE-2026-122059)
The WP ImageViewer plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img.alt' parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires a front-end content plugin such as bbPress to be active, as it grants Subscriber-level users the bbp_participant capability needed to publish image-bearing content containing the encoded…
PLUGIN
Wp Imageviewer
CVE-2026-122059
Risk Score
Threat Entry
Updated 2026-11-07
Modula Best Grid Gallery - Security Vulnerability (CVE-2026-121976)
The Modula plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'items' parameter in versions up to, and including, 3.0.17 This is due to insufficient input sanitization of the per-image 'link' field in the save_merged_items() REST handler and Images\Adapter::normalize_item_row(), which preserves unknown keys verbatim, combined with output escaping in Modula_Helper::generate_attributes() that applies only esc_attr() to the resulting anchor href and does not strip the 'javascript:' URL scheme. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will…
PLUGIN
Modula Best Grid Gallery
CVE-2026-121976
Risk Score
Threat Entry
Updated 2026-11-07
Jetformbuilder - Security Vulnerability (CVE-2026-121977)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note (form field whose value is written to post meta `note`)' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged user with the edit_others_posts capability to visit a form URL containing the attacker-created post ID,…
PLUGIN
Jetformbuilder
CVE-2026-121977
Risk Score
Threat Entry
Updated 2026-11-07
Registration Form For Woocommerce - Security Vulnerability (CVE-2026-119075)
The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields()) validates a submitted 'tgwcfb/user-roles' value against the form's configured allowed roles, but the checkout registration path (validate_checkout_fields(), hooked to woocommerce_after_checkout_validation) stores the raw $_POST['user_roles'] value in $this->valid_data without any allow-list enforcement, and add_user_data() then injects that value into woocommerce_new_customer_data as the new account's role. This makes it possible for unauthenticated attackers to elevate their…
PLUGIN
Registration Form For Woocommerce
CVE-2026-119075
Risk Score
Threat Entry
Updated 2026-11-07
Jetformbuilder - Security Vulnerability (CVE-2026-119183)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to have configured a public Insert Post form writing to a post meta key and a Calculated Field whose formula references that key via the…
PLUGIN
Jetformbuilder
CVE-2026-119183
Risk Score
Threat Entry
Updated 2026-11-07
Testimonial Free - Security Vulnerability (CVE-2026-120685)
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_image (JPEG IPTC caption) + tpro_client_testimonial ([gallery] shortcode)' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have the display block configured with the Strip All HTML Tags option disabled,…
PLUGIN
Testimonial Free
CVE-2026-120685
Risk Score
Threat Entry
Updated 2026-11-07
Testimonial Free - Security Vulnerability (CVE-2026-120683)
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_testimonial' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to approve the pending testimonial through standard moderation and the target page to load the WordPress Interactivity runtime (e.g. a…
PLUGIN
Testimonial Free
CVE-2026-120683
Risk Score
Threat Entry
Updated 2026-11-07
Simple Cloudflare Turnstile - Security Vulnerability (CVE-2026-119498)
Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Authentication Abuse.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.4.
PLUGIN
Simple Cloudflare Turnstile
CVE-2026-119498
Risk Score
Threat Entry
Updated 2026-11-07
Testimonial Free - Security Vulnerability (CVE-2026-120509)
The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_name' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to publish the submitted testimonial, trigger the Show Preview AJAX handler, and save an Update, which canonicalizes and persists the…
PLUGIN
Testimonial Free
CVE-2026-120509
Risk Score
Threat Entry
Updated 2026-11-08
Appointment Booking Plugin - Security Vulnerability (CVE-2026-118066)
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()` function in `lib/models/model.php` comparing WHERE-clause values against the literal strings `'IS NULL'` and `'IS NOT NULL'` and concatenating a match directly into SQL without binding it as a parameter, a flaw that neither `sanitize_text_field()` nor the 5.7.5 `is_scalar()` hardening guard closes, since both pass the scalar sentinel through unchanged. This makes it possible…
PLUGIN
Appointment Booking Plugin
CVE-2026-118066
Risk Score
Threat Entry
Updated 2026-11-07
Wp Data Access - Security Vulnerability (CVE-2026-118267)
The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Incorrect Authorization leading to Privilege Escalation in all versions up to, and including, 5.5.89 This is due to the plugin's write endpoints (`wpda/app/update`, `wpda/app/delete`, `wpda/app/insert`) passing the attacker-supplied `key` and `val` parameters directly to `$wpdadb->update`, `$wpdadb->delete`, and `$wpdadb->insert` without enforcing the container's row-filter (`defaultWhere`) or per-column allow-list (`isSelected`) restrictions that are correctly applied on the read endpoints. This makes it possible for authenticated attackers, with Subscriber-level access and above, to…
PLUGIN
Wp Data Access
CVE-2026-118267
Risk Score
Threat Entry
Updated 2026-11-08
Ameliabooking - Security Vulnerability (CVE-2026-116751)
The Booking for Appointments and Events Calendar – Amelia Pro plugin for WordPress is vulnerable to time-based SQL Injection via the 'tag[] (array KEYS)' parameter in all versions up to, and including, 9.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress's wp_magic_quotes escapes array values but not array keys, meaning attacker-controlled…
PLUGIN
Ameliabooking
CVE-2026-116751
Risk Score
Threat Entry
Updated 2026-11-07
Football Pool - Security Vulnerability (CVE-2026-118050)
The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shouttext' parameter in all versions up to, and including, 2.13.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script only fires in the admin Edit view for a shout; the public Shoutbox widget and the admin list view both encode output via Football_Pool_Utils::xssafe(), making the…
PLUGIN
Football Pool
CVE-2026-118050
Risk Score
Threat Entry
Updated 2026-11-07
Falang multilanguage for - Security Vulnerability (CVE-2026-118047)
The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'falang_term[][][] (via order[] driving wp_update_term)' parameter in all versions up to, and including, 1.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made reliable because the required 'falang' nonce is disclosed to any logged-in user through the equally unprotected wp_ajax_falang_menu_translation handler, requiring…
PLUGIN
Falang multilanguage for
CVE-2026-118047
Risk Score
Threat Entry
Updated 2026-11-07
Image Hover Effects Ultimate - Security Vulnerability (CVE-2026-118056)
The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rawdata.oxi_image_comparison_before_text' parameter in all versions up to, and including, 9.12.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured the plugin's "Who can edit" setting to Subscriber, which…
PLUGIN
Image Hover Effects Ultimate
CVE-2026-118056
Risk Score
Threat Entry
Updated 2026-11-07
Funnelkit Stripe Woo Payment Gateway - Security Vulnerability (CVE-2026-109991)
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay//)' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full billing PII — including name, email address, phone number, and complete street address — of any store order by enumerating sequential order IDs, as this data is emitted into the inline fkwcs_data JavaScript object via wp_localize_script…
PLUGIN
Funnelkit Stripe Woo Payment Gateway
CVE-2026-109991
Risk Score
Threat Entry
Updated 2026-11-07
Link Library - Security Vulnerability (CVE-2026-116537)
The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_description' parameter in all versions up to, and including, 7.10.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This exploit requires the site administrator to have enabled the non-default 'Convert [] to in Link Description and Notes' (use_html_tags) setting; when this option is off, the bracket-to-angle-bracket conversion never runs and the payload…
PLUGIN
Link Library
CVE-2026-116537
Risk Score
Threat Entry
Updated 2026-11-07
Quttera Web Malware Scanner - Security Vulnerability (CVE-2026-115548)
The Quttera ThreatSign – Web Malware Scanner for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT' parameter in all versions up to, and including, 4.1.0.48 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses an injected page.
PLUGIN
Quttera Web Malware Scanner
CVE-2026-115548
Risk Score
Threat Entry
Updated 2026-11-07
Wp Stats Manager - Security Vulnerability (CVE-2026-111370)
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'os (also browser, res)' parameter in all versions up to, and including, 8.9.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Wp Stats Manager
CVE-2026-111370
Risk Score