Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-08
Everest Forms - Security Vulnerability (CVE-2026-94670)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1.
PLUGIN
Everest Forms
CVE-2026-94670
Risk Score
Threat Entry
Updated 2026-10-08
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-94662)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-94662
Risk Score
Threat Entry
Updated 2026-10-07
Slider by 10Web - Security Vulnerability (CVE-2026-42710)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63.
PLUGIN
Slider by 10Web
CVE-2026-42710
Risk Score
Threat Entry
Updated 2026-10-07
Wp Post Author - Security Vulnerability (CVE-2026-42708)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.
PLUGIN
Wp Post Author
CVE-2026-42708
Risk Score
Threat Entry
Updated 2026-10-07
Pix Por Piggly - Security Vulnerability (CVE-2026-42714)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce) pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly (para Woocommerce): from n/a through 2.1.2.
PLUGIN
Pix Por Piggly
CVE-2026-42714
Risk Score
Threat Entry
Updated 2026-10-07
Post Title Marquee Scroll - Security Vulnerability (CVE-2026-42713)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9.
PLUGIN
Post Title Marquee Scroll
CVE-2026-42713
Risk Score
Threat Entry
Updated 2026-10-07
Media Library Assistant - Security Vulnerability (CVE-2026-97294)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.
PLUGIN
Media Library Assistant
CVE-2026-97294
Risk Score
Threat Entry
Updated 2026-10-07
Affiliate Toolkit - Security Vulnerability (CVE-2026-42721)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1.
PLUGIN
Affiliate Toolkit
CVE-2026-42721
Risk Score
Threat Entry
Updated 2026-10-07
Dynamic User Directory - Security Vulnerability (CVE-2026-42720)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4.
PLUGIN
Dynamic User Directory
CVE-2026-42720
Risk Score
Threat Entry
Updated 2026-10-07
Rocket Lazy Load - Security Vulnerability (CVE-2026-105884)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0.
PLUGIN
Rocket Lazy Load
CVE-2026-105884
Risk Score
Threat Entry
Updated 2026-10-07
Bdthemes Prime Slider Lite - Security Vulnerability (CVE-2026-105875)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.6.2.
PLUGIN
Bdthemes Prime Slider Lite
CVE-2026-105875
Risk Score
Threat Entry
Updated 2026-10-07
Bdthemes Element Pack Lite - Security Vulnerability (CVE-2026-105873)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
PLUGIN
Bdthemes Element Pack Lite
CVE-2026-105873
Risk Score
Threat Entry
Updated 2026-10-07
Modula Best Grid Gallery - Security Vulnerability (CVE-2026-105876)
Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11.
PLUGIN
Modula Best Grid Gallery
CVE-2026-105876
Risk Score
Threat Entry
Updated 2026-10-07
WP Rentals - Security Vulnerability (CVE-2026-27434)
Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rentals: from n/a through 3.14.2.
PLUGIN
WP Rentals
CVE-2026-27434
Risk Score
Threat Entry
Updated 2026-10-07
Bdthemes Element Pack Lite - Security Vulnerability (CVE-2026-105871)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.6.
PLUGIN
Bdthemes Element Pack Lite
CVE-2026-105871
Risk Score
Threat Entry
Updated 2026-10-07
Happy Elementor Addons - Security Vulnerability (CVE-2026-104393)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.
PLUGIN
Happy Elementor Addons
CVE-2026-104393
Risk Score
Threat Entry
Updated 2026-10-07
Quiz And Survey Master - Security Vulnerability (CVE-2026-104391)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
PLUGIN
Quiz And Survey Master
CVE-2026-104391
Risk Score
Threat Entry
Updated 2026-10-07
Booktics - Security Vulnerability (CVE-2026-104390)
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.
PLUGIN
Booktics
CVE-2026-104390
Risk Score
Threat Entry
Updated 2026-10-07
Wordpress Popup - Security Vulnerability (CVE-2026-103075)
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.
PLUGIN
Wordpress Popup
CVE-2026-103075
Risk Score
Threat Entry
Updated 2026-10-07
Host Webfonts Local - Security Vulnerability (CVE-2026-89417)
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the front-end server serves the retained .tmp file without a Content-Type or X-Content-Type-Options header, enabling MIME-sniffing browsers such as Chromium to…
PLUGIN
Host Webfonts Local
CVE-2026-89417
Risk Score