Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-08
Yith Woocommerce Product Bundles - Security Vulnerability (CVE-2026-105878)
Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.
PLUGIN
Yith Woocommerce Product Bundles
CVE-2026-105878
Risk Score
Threat Entry
Updated 2026-10-08
Vitepos Lite - Security Vulnerability (CVE-2026-105076)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1.
PLUGIN
Vitepos Lite
CVE-2026-105076
Risk Score
Threat Entry
Updated 2026-10-08
Wp Store Locator - Security Vulnerability (CVE-2026-105078)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-store-locator allows Stored XSS.This issue affects WP Store Locator: from n/a through 3.0.3.
PLUGIN
Wp Store Locator
CVE-2026-105078
Risk Score
Threat Entry
Updated 2026-10-08
Shortpixel Image Optimiser - Security Vulnerability (CVE-2026-103070)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.6.
PLUGIN
Shortpixel Image Optimiser
CVE-2026-103070
Risk Score
Threat Entry
Updated 2026-10-08
Villatheme Core - Security Vulnerability (CVE-2026-103072)
Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5.
PLUGIN
Villatheme Core
CVE-2026-103072
Risk Score
Threat Entry
Updated 2026-10-08
Wallet System for WooCommerce - Security Vulnerability (CVE-2026-93509)
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.
PLUGIN
Wallet System for WooCommerce
CVE-2026-93509
Risk Score
Threat Entry
Updated 2026-10-08
Easy Digital Downloads - Security Vulnerability (CVE-2026-105190)
The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.
PLUGIN
Easy Digital Downloads
CVE-2026-105190
Risk Score
Threat Entry
Updated 2026-10-08
TutorStarter - Security Vulnerability (CVE-2026-104671)
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
THEME
TutorStarter
CVE-2026-104671
Risk Score
Threat Entry
Updated 2026-10-08
Airwallex Online Payments Gateway - Security Vulnerability (CVE-2026-103517)
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.
PLUGIN
Airwallex Online Payments Gateway
CVE-2026-103517
Risk Score
Threat Entry
Updated 2026-10-08
Bricksforge - Security Vulnerability (CVE-2026-85097)
The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated…
PLUGIN
Bricksforge
CVE-2026-85097
Risk Score
Threat Entry
Updated 2026-10-08
Track Orders for WooCommerce - Security Vulnerability (CVE-2026-94275)
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.
PLUGIN
Track Orders for WooCommerce
CVE-2026-94275
Risk Score
Threat Entry
Updated 2026-10-08
phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert - Security Vulnerability (CVE-2026-94258)
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
PLUGIN
phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert
CVE-2026-94258
Risk Score
Threat Entry
Updated 2026-10-08
Wallet System for WooCommerce - Security Vulnerability (CVE-2026-94245)
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.
PLUGIN
Wallet System for WooCommerce
CVE-2026-94245
Risk Score
Threat Entry
Updated 2026-10-08
Wallet System for WooCommerce - Security Vulnerability (CVE-2026-94246)
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.
PLUGIN
Wallet System for WooCommerce
CVE-2026-94246
Risk Score
Threat Entry
Updated 2026-10-08
Wallet System for WooCommerce - Security Vulnerability (CVE-2026-94244)
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.
PLUGIN
Wallet System for WooCommerce
CVE-2026-94244
Risk Score
Threat Entry
Updated 2026-10-08
BackWPup - Security Vulnerability (CVE-2026-86828)
The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.
PLUGIN
BackWPup
CVE-2026-86828
Risk Score
Threat Entry
Updated 2026-10-08
BackWPup - Security Vulnerability (CVE-2026-86826)
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
PLUGIN
BackWPup
CVE-2026-86826
Risk Score
Threat Entry
Updated 2026-10-08
BackWPup - Security Vulnerability (CVE-2026-86827)
The BackWPup WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.
PLUGIN
BackWPup
CVE-2026-86827
Risk Score
Threat Entry
Updated 2026-10-08
Database Addon For WPForms - Security Vulnerability (CVE-2026-105260)
The Database Addon For WPForms ( wpforms entries ) WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafted page.
PLUGIN
Database Addon For WPForms
CVE-2026-105260
Risk Score
Threat Entry
Updated 2026-10-08
Appointment Booking Plugin - Security Vulnerability (CVE-2026-105198)
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.
PLUGIN
Appointment Booking Plugin
CVE-2026-105198
Risk Score