Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
CVE-2026-39494 - Product Filter by WBW Plugin
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.
PLUGIN
Product Filter by WBW
CVE-2026-39494
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-42653 - SliceWP Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.6.
PLUGIN
SliceWP
CVE-2026-42653
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-46698 - fediverse-embeds-wordpress-plugin
Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.9, Fediverse Embeds registered the unauthenticated AJAX action wp_ajax_nopriv_ftf_get_site_info (includes/Site_Info.php) that verified a nonce ftf-fediverse-embeds-nonce and then called file_get_html($site_url) on the attacker-supplied URL. The same nonce was enqueued onto every public page containing a fediverse embed (via includes/Enqueue_Assets.php lines 41-46 + includes/Helpers.php lines 64-83), so the nonce gate was not an authentication boundary; any visitor of a public post with an embed could grab it and reuse it. This issue has been patched in version 1.5.9.
PLUGIN
fediverse-embeds-wordpress-plugin
CVE-2026-46698
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-46697 - fediverse-embeds-wordpress-plugin
Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST route ftf/media-proxy (includes/Media_Proxy.php) with permission_callback => __return_true that accepted a base64-encoded URL and forwarded it to wp_remote_get($url) without enforcing any allowlist. The plugin's source contained a comment block explicitly acknowledging that the request should be validated against allowed fediverse domains, but in 1.5.7 the validation only set a local $can_download_media flag that was never read. The full response body was echoed back to the caller, so this was a full-read SSRF /…
PLUGIN
fediverse-embeds-wordpress-plugin
CVE-2026-46697
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-10795 - UpdraftPlus: WP Backup & Migration Plugin
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code…
PLUGIN
UpdraftPlus: WP Backup & Migration Plugin
CVE-2026-10795
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-2827 - Open User Map Pro Plugin
The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in versions up to, and including, 1.4.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Open User Map Pro
CVE-2026-2827
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-53738 - Copy & Delete Posts Plugin
Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.
PLUGIN
Copy & Delete Posts
CVE-2026-53738
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-53742 - Simple Link Directory Plugin
Simple Link Directory through 9.0.4 echoes embed shortcode attributes into HTML data attributes without escaping in the embedder template. Attackers with contributor access can craft a shortcode attribute that injects an event handler executing in a viewer's browser.
PLUGIN
Simple Link Directory
CVE-2026-53742
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-53741 - Simple Link Directory Plugin
Simple Link Directory through 9.0.4 interpolates the sld_no_results_found option into a JavaScript string literal without encoding. Because sanitize_text_field leaves quotes intact, a stored payload breaks out of the string and runs script for every page visitor.
PLUGIN
Simple Link Directory
CVE-2026-53741
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-53740 - Duplicate Post Plugin
Yoast Duplicate Post through 4.6 inserts an unescaped post title and permalink into the Classic Editor scheduled republish notice. Attackers can schedule a republish copy with a crafted title to execute script when an administrator views the resulting notice.
PLUGIN
Duplicate Post
CVE-2026-53740
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-53739 - Duplicate Post Plugin
Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate_post_dismiss_notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate_post_show_notice site option, suppressing admin notices network-wide.
PLUGIN
Duplicate Post
CVE-2026-53739
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-53737 - Juicer Plugin
Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.
PLUGIN
Juicer
CVE-2026-53737
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-53736 - Easy Twitter Feeds Plugin
Easy Twitter Feeds before 1.2.13 contains a cross-site request forgery vulnerability in the duplicate_post action handler that lacks nonce verification. Attackers can trick an authenticated user into visiting a crafted link that duplicates any post regardless of post type.
PLUGIN
Easy Twitter Feeds
CVE-2026-53736
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-49069 - WPZOOM Portfolio Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio allows Reflected XSS. This issue affects WPZOOM Portfolio: from n/a through 1.4.21.
PLUGIN
WPZOOM Portfolio
CVE-2026-49069
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-3018 - Newsletters Lite Plugin
The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Newsletters Lite
CVE-2026-3018
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-9019 - Easy Image Collage Plugin
The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress's unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path…
PLUGIN
Easy Image Collage
CVE-2026-9019
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-8613 - Athemes Addons For Elementor Lite Plugin
The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widget Setting in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This affects the Posts Timeline widget as well as the Posts Carousel widget across its default, Banner, and Modern skins, all of which omit the whitelist validation…
PLUGIN
Athemes Addons For Elementor Lite
CVE-2026-8613
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-8853 - Mw Wp Form Plugin
The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the memo value is stored via update_post_meta() rather than wp_insert_post(), WordPress's built-in kses and unfiltered_html protections do not apply, allowing attackers to break out of the textarea…
PLUGIN
Mw Wp Form
CVE-2026-8853
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-9067 - Before 1 Plugin
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
PLUGIN
Before 1
CVE-2026-9067
Risk Score
Threat Entry
Updated 2026-07-23
CVE-2026-8071 - Spam Protection Plugin
The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.
PLUGIN
Spam Protection
CVE-2026-8071
Risk Score