Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-09
Code Snippets - Security Vulnerability (CVE-2026-106095)
The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.
PLUGIN
Code Snippets
CVE-2026-106095
Risk Score
Threat Entry
Updated 2026-10-08
Ablocks - Security Vulnerability (CVE-2026-40804)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.
PLUGIN
Ablocks
CVE-2026-40804
Risk Score
Threat Entry
Updated 2026-10-09
Mainwp Child - Security Vulnerability (CVE-2026-105436)
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
PLUGIN
Mainwp Child
CVE-2026-105436
Risk Score
Threat Entry
Updated 2026-10-08
Zotpress - Security Vulnerability (CVE-2026-27420)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through 7.4.4.
PLUGIN
Zotpress
CVE-2026-27420
Risk Score
Threat Entry
Updated 2026-10-08
Tutor - Security Vulnerability (CVE-2026-42698)
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.
PLUGIN
Tutor
CVE-2026-42698
Risk Score
Threat Entry
Updated 2026-10-08
Wp 2fa - Security Vulnerability (CVE-2026-62142)
Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.
PLUGIN
Wp 2fa
CVE-2026-62142
Risk Score
Threat Entry
Updated 2026-10-08
Wpcomplete - Security Vulnerability (CVE-2026-66479)
Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.
PLUGIN
Wpcomplete
CVE-2026-66479
Risk Score
Threat Entry
Updated 2026-10-08
Wp Plugin Info Card - Security Vulnerability (CVE-2026-62127)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5.
PLUGIN
Wp Plugin Info Card
CVE-2026-62127
Risk Score
Threat Entry
Updated 2026-10-10
Creatorlms - Security Vulnerability (CVE-2026-62128)
Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21.
PLUGIN
Creatorlms
CVE-2026-62128
Risk Score
Threat Entry
Updated 2026-10-08
Forminator - Security Vulnerability (CVE-2026-106611)
Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.
PLUGIN
Forminator
CVE-2026-106611
Risk Score
Threat Entry
Updated 2026-10-08
Holler Box - Security Vulnerability (CVE-2026-106603)
Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.
PLUGIN
Holler Box
CVE-2026-106603
Risk Score
Threat Entry
Updated 2026-10-08
Give - Security Vulnerability (CVE-2026-106600)
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.
PLUGIN
Give
CVE-2026-106600
Risk Score
Threat Entry
Updated 2026-10-08
Visual Composer Website Builder - Security Vulnerability (CVE-2026-106596)
Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Composer Website Builder: from n/a through 45.16.3.
PLUGIN
Visual Composer Website Builder
CVE-2026-106596
Risk Score
Threat Entry
Updated 2026-10-08
Event Tickets - Security Vulnerability (CVE-2026-105893)
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.
PLUGIN
Event Tickets
CVE-2026-105893
Risk Score
Threat Entry
Updated 2026-10-10
Event Tickets - Security Vulnerability (CVE-2026-105891)
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
PLUGIN
Event Tickets
CVE-2026-105891
Risk Score
Threat Entry
Updated 2026-10-08
Kadence Blocks - Security Vulnerability (CVE-2026-105890)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12.
PLUGIN
Kadence Blocks
CVE-2026-105890
Risk Score
Threat Entry
Updated 2026-10-08
Robo Gallery - Security Vulnerability (CVE-2026-105887)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affects Robo Gallery: from n/a through 5.1.6.
PLUGIN
Robo Gallery
CVE-2026-105887
Risk Score
Threat Entry
Updated 2026-10-08
Ultimate Post Kit - Security Vulnerability (CVE-2026-105886)
Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through 4.5.5.
PLUGIN
Ultimate Post Kit
CVE-2026-105886
Risk Score
Threat Entry
Updated 2026-10-10
Masterstudy Lms Learning Management System - Security Vulnerability (CVE-2026-105079)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.
PLUGIN
Masterstudy Lms Learning Management System
CVE-2026-105079
Risk Score
Threat Entry
Updated 2026-10-08
Event Tickets - Security Vulnerability (CVE-2026-105888)
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
PLUGIN
Event Tickets
CVE-2026-105888
Risk Score