Threat Entry Updated 2026-07-23

CVE-2026-8438 - All In One Wp Security And Firewall Plugin

The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the get_rest_route() function and missing output escaping in the column_default() method of the debug log list table. When the 'Disable REST API for non-logged in users' feature (aiowps_disallow_unauthorized_rest_requests) is enabled alongside debug logging (aiowps_enable_debug), an unauthenticated attacker can embed arbitrary HTML or JavaScript in the REST request path. The path is retrieved via urldecode($_SERVER['REQUEST_URI']), which decodes URL-encoded payloads…

PLUGIN All In One Wp Security And Firewall

CVE-2026-8438

HIGH CVSS 7.2 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-9290 - Wp User Manager Plugin

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

PLUGIN Wp User Manager

CVE-2026-9290

HIGH CVSS 7.5 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-8900 - Simple Seo Slideshow Plugin

The Simple SEO Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress KSES does not strip malicious shortcode attribute values on post save, allowing contributor-level users to persist payloads that execute for any visitor, including administrators reviewing the post.

PLUGIN Simple Seo Slideshow

CVE-2026-8900

MEDIUM CVSS 6.4 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-9719 - Calendar Booking Plugin For Appointments And Events

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.6.0. This is due to missing or incorrect nonce validation on the change_status function. This makes it possible for unauthenticated attackers to change the status of arbitrary invoices — including marking unpaid invoices as paid — without administrator consent via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Calendar Booking Plugin For Appointments And Events

CVE-2026-9719

MEDIUM CVSS 4.3 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-8976 - RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Theme

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to create and execute RSS import jobs, purge (force-delete) all posts associated with any import job, clear import error logs, and enumerate taxonomy terms and post meta_key names.…

THEME RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

CVE-2026-8976

MEDIUM CVSS 4.3 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-8893 - Express Payment For Stripe Plugin

The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-express] shortcode in versions up to, and including, 1.28.0. This is due to insufficient input sanitization and output escaping on the shortcode attribute value, which is concatenated into an HTML attribute in the rendered output of the register_shortcode() function without being passed through esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will…

PLUGIN Express Payment For Stripe

CVE-2026-8893

MEDIUM CVSS 6.4 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-8608 - Event Monster – Event Manager, Ticket Booking & Registration Plugin

The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in versions up to, and including, 2.1.0. This is due to the capture_payment() AJAX handler (registered via wp_ajax_nopriv_em_capture_payment) trusting client-supplied payment data — including transaction ID, amount, and payment status — without performing any server-side verification against the PayPal API or any other payment gateway, and without nonce or capability checks. This makes it possible for unauthenticated attackers to forge payment records, mark bookings as Completed, and obtain confirmation emails…

PLUGIN Event Monster – Event Manager, Ticket Booking & Registration

CVE-2026-8608

MEDIUM CVSS 5.3 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-6448 - Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker Plugin

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. If the secret key is…

PLUGIN Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

CVE-2026-6448

MEDIUM CVSS 4.9 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-7047 - Frontend User Notes Plugin

The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the funp_ajax_modify_notes function. This makes it possible for unauthenticated attackers to trick a logged-in user into visiting a malicious page, causing unauthorized overwriting of that victim's own note content via a forged cross-site request to wp_update_post() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to…

PLUGIN Frontend User Notes

CVE-2026-7047

MEDIUM CVSS 4.3 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-10038 - Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insecure Direct Object Reference / Authorization Bypass leading to Arbitrary Attachment Deletion in versions up to, and including, 1.8.11.1 via the profile avatar update flow. This is due to the save_avatar() function in Charitable_Profile_Form calling wp_delete_attachment() on an attachment ID read from the user's 'avatar' meta without validating that the attachment is owned by the user, combined with Charitable_Data_Processor::process_picture() returning the raw posted value when no file is uploaded, allowing…

PLUGIN Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

CVE-2026-10038

MEDIUM CVSS 4.3 2026-06-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-7654 - Codepress Admin Columns Plugin

The Admin Columns plugin for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution in versions up to and including 7.0.18. This is due to the use of `unserialize()` without an `allowed_classes` restriction in the `IdsToCollection::get_ids_from_string()` function, which processes attacker-controlled post meta values without proper validation. This makes it possible for authenticated attackers with Contributor-level access and above to inject a serialized PHP object into a post's custom meta field and trigger arbitrary code execution by exploiting a bundled POP gadget chain, resulting in remote code execution…

PLUGIN Codepress Admin Columns

CVE-2026-7654

HIGH CVSS 8.8 2026-06-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-7523 - Alba Board Plugin

The Alba Board plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to access arbitrary private alba_card post data, including title, description, assignee, due date, tags, and comments, that is intended to be restricted to Administrators and Editors. The handler is registered via the wp_ajax_nopriv_ hook and its nonce is exposed to all…

PLUGIN Alba Board

CVE-2026-7523

MEDIUM CVSS 4.3 2026-06-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-5415 - WordPress component

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_temporary_links() function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed…

UNKNOWN WordPress component

CVE-2026-5415

HIGH CVSS 8.8 2026-06-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-5411 - WordPress component

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the…

UNKNOWN WordPress component

CVE-2026-5411

HIGH CVSS 8.8 2026-06-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

CVE-2026-10580 - Hippoo Mobile App For Woocommerce Plugin

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated…

PLUGIN Hippoo Mobile App For Woocommerce

CVE-2026-10580

CRITICAL CVSS 9.8 2026-06-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-49777 - Product Slider Pro for WooCommerce Plugin

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.3. No patched version is available - the vendor has applied a fix to an existing release without publishing a new version. While the patch provided by the vendor is valid, releasing it under the existing version number leaves users unable to reliably determine whether they are running a patched or vulnerable installation. As a result, we treat this…

PLUGIN Product Slider Pro for WooCommerce

CVE-2026-49777

CRITICAL CVSS 10.0 2026-06-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-23

CVE-2026-10586 - Essential Blocks Plugin

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

PLUGIN Essential Blocks

CVE-2026-10586

HIGH CVSS 7.2 2026-06-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-22

CVE-2026-49077 - WP eMember Plugin

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Data. This issue affects WP eMember: from n/a through v10.2.2.

PLUGIN WP eMember

CVE-2026-49077

MEDIUM CVSS 5.3 2026-06-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-22

CVE-2026-49771 - Photo Gallery by 10Web Plugin

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Gallery by 10Web allows Blind SQL Injection. This issue affects Photo Gallery by 10Web: from n/a through 1.8.41.

PLUGIN Photo Gallery by 10Web

CVE-2026-49771

HIGH CVSS 7.6 2026-06-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-22

CVE-2026-10737 - Sp Client Document Manager Plugin

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive information. The authorization gate uses a negated nonce check OR-chained with permission checks, meaning a missing or invalid nonce causes the entire condition to evaluate to true and bypass…

PLUGIN Sp Client Document Manager

CVE-2026-10737

HIGH CVSS 7.5 2026-06-04

Risk Score

Open Full Technical Breakdown