Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-07
String locator - Security Vulnerability (CVE-2026-97188)
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.
PLUGIN
String locator
CVE-2026-97188
Risk Score
Threat Entry
Updated 2026-10-07
Optimole - Security Vulnerability (CVE-2026-96530)
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
PLUGIN
Optimole
CVE-2026-96530
Risk Score
Threat Entry
Updated 2026-10-07
User Private Files - Security Vulnerability (CVE-2026-97331)
The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.
PLUGIN
User Private Files
CVE-2026-97331
Risk Score
Threat Entry
Updated 2026-10-07
PowerPress Podcasting plugin by Blubrry - Security Vulnerability (CVE-2026-97354)
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services.
PLUGIN
PowerPress Podcasting plugin by Blubrry
CVE-2026-97354
Risk Score
Threat Entry
Updated 2026-10-07
Koinonia Link - Security Vulnerability (CVE-2026-87782)
The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a profile update, allowing any authenticated user, such as a subscriber, to grant themselves the Administrator role.
PLUGIN
Koinonia Link
CVE-2026-87782
Risk Score
Threat Entry
Updated 2026-10-07
Nexi XPay Build - Security Vulnerability (CVE-2026-82211)
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details.
PLUGIN
Nexi XPay Build
CVE-2026-82211
Risk Score
Threat Entry
Updated 2026-10-07
Nexi XPay Build - Security Vulnerability (CVE-2026-82212)
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the request when the target order has no stored token, which allows unauthenticated attackers to mark arbitrary orders as paid, or to mark genuinely paid orders as failed.
PLUGIN
Nexi XPay Build
CVE-2026-82212
Risk Score
Threat Entry
Updated 2026-10-07
If-So Dynamic Content - Security Vulnerability (CVE-2026-87971)
The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.
PLUGIN
If-So Dynamic Content
CVE-2026-87971
Risk Score
Threat Entry
Updated 2026-10-07
MetForm - Security Vulnerability (CVE-2026-86833)
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
PLUGIN
MetForm
CVE-2026-86833
Risk Score
Threat Entry
Updated 2026-10-07
WPCafe - Security Vulnerability (CVE-2026-86816)
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.
PLUGIN
WPCafe
CVE-2026-86816
Risk Score
Threat Entry
Updated 2026-10-07
Magee Shortcodes - Security Vulnerability (CVE-2026-105316)
The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.
PLUGIN
Magee Shortcodes
CVE-2026-105316
Risk Score
Threat Entry
Updated 2026-10-07
Magee Shortcodes - Security Vulnerability (CVE-2026-105322)
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).
PLUGIN
Magee Shortcodes
CVE-2026-105322
Risk Score
Threat Entry
Updated 2026-10-07
WP Coder - Security Vulnerability (CVE-2026-104677)
The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromise the site.
PLUGIN
WP Coder
CVE-2026-104677
Risk Score
Threat Entry
Updated 2026-10-07
MPG - Security Vulnerability (CVE-2026-104953)
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
PLUGIN
MPG
CVE-2026-104953
Risk Score
Threat Entry
Updated 2026-10-07
Animated Number Counters - Security Vulnerability (CVE-2026-104667)
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes.
PLUGIN
Animated Number Counters
CVE-2026-104667
Risk Score
Threat Entry
Updated 2026-10-07
Envira Gallery - Security Vulnerability (CVE-2026-104653)
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
PLUGIN
Envira Gallery
CVE-2026-104653
Risk Score
Threat Entry
Updated 2026-10-07
CP Media Player - Security Vulnerability (CVE-2026-104678)
The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin before 1.3.4 option that should require administrator access.
PLUGIN
CP Media Player
CVE-2026-104678
Risk Score
Threat Entry
Updated 2026-10-07
Envira Gallery - Security Vulnerability (CVE-2026-104652)
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
PLUGIN
Envira Gallery
CVE-2026-104652
Risk Score
Threat Entry
Updated 2026-10-07
Kargo Pazaryeri - Security Vulnerability (CVE-2026-103378)
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers to retrieve the key and use it to modify WooCommerce order statuses. The same log file also exposes customer information from orders the shop has processed.
PLUGIN
Kargo Pazaryeri
CVE-2026-103378
Risk Score
Threat Entry
Updated 2026-10-07
Integration for Epos Now and WooCommerce - Security Vulnerability (CVE-2026-103323)
The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers.
PLUGIN
Integration for Epos Now and WooCommerce
CVE-2026-103323
Risk Score