Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-22
CVE-2026-42669 - EventPrime Plugin
Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.
PLUGIN
EventPrime
CVE-2026-42669
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-42685 - WP Job Portal Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.
PLUGIN
WP Job Portal
CVE-2026-42685
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-5191 - Tiled Gallery Carousel Without Jetpack Plugin
The Tiled Gallery Carousel Without JetPack plugin for WordPress is vulnerable to stored cross-site scripting via the 'data-image-title' parameter in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Tiled Gallery Carousel Without Jetpack
CVE-2026-5191
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-9730 - Remove Nofollow Commenter Link Plugin
The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the gmz_comment_settings_save function. This makes it possible for unauthenticated attackers to modify the plugin's comment-display setting via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Remove Nofollow Commenter Link
CVE-2026-9730
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-9723 - Google Plus One Bottom Plugin
The Google Plus One Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.2. This is due to missing or incorrect nonce validation on the googlePlusOneAdmin function. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the plusone-lang, plusone-callback, and plusone-url options stored in the database via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Google Plus One Bottom
CVE-2026-9723
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-9722 - Laiser Tag Plugin
The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the addOptionsPageFields function. This makes it possible for unauthenticated attackers to update the plugin's settings, including the API key, tag blacklist, relevance threshold, batch size, and tagging toggles, via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Laiser Tag
CVE-2026-9722
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-9599 - Tectite Forms Plugin
The Tectite Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the admin_init function. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the tectite_forms_button option, via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Tectite Forms
CVE-2026-9599
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-9234 - Jtl Connector For Woocommerce Plugin
The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This is due to missing capability checks and nonce verification on the admin_post_settings_save_woo-jtl-connector action (handled by JtlConnectorAdmin::save()) and on the wp_ajax_downloadJTLLogs and wp_ajax_clearJTLLogs AJAX actions (handled by the global downloadJTLLogs() and clearJTLLogs() functions). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary plugin settings, download a ZIP archive of the connector's developer log files, and delete those log files.
PLUGIN
Jtl Connector For Woocommerce
CVE-2026-9234
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-8885 - Demomentsomtres Shortcodes Plugin
The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callout' shortcode in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on the 'width' and 'align' shortcode attributes within the st_callout() function, which concatenates the attribute values directly into an HTML style attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Demomentsomtres Shortcodes
CVE-2026-8885
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-4081 - Zem Stl Viewer Plugin
The ZeM STL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [zemstl] shortcode in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes, specifically the 'url', 'color', and 'bgcolor' parameters. These attribute values are directly interpolated into HTML attribute context without being passed through esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user…
PLUGIN
Zem Stl Viewer
CVE-2026-4081
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-4080 - Easy Cart Plugin
The Easy Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_to_cart' shortcode in all versions up to and including 1.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the ectp_add_to_cart() function uses sanitize_text_field() on shortcode attributes like 'itemid', 'product_name', 'product_desc', 'product_qty', and 'price' before inserting them into double-quoted HTML attributes. While sanitize_text_field() strips HTML tags, it does not escape double quote characters, allowing an attacker to break out of the HTML attribute context and inject arbitrary event handlers. This…
PLUGIN
Easy Cart
CVE-2026-4080
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-3620 - Word Replacer Plugin
The Word Replacer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replacement' parameter in all versions up to, and including, 0.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Word Replacer
CVE-2026-3620
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-8422 - Remove Meta Boxes Per User Role Plugin
The Remove meta boxes per user role plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.01. This is due to missing or incorrect nonce validation on the 'remove-meta-boxes-per-user-role' page. This makes it possible for unauthenticated attackers to modify or reset the plugin's per-role meta box visibility settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Remove Meta Boxes Per User Role
CVE-2026-8422
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-4071 - Birdseed Plugin
The BirdSeed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing nonce validation in the birdseed_plugin_settings_page() function. The function processes the 'birdseed_token' GET parameter and saves it to the database via update_option() without verifying a nonce. This makes it possible for unauthenticated attackers to change the plugin's BirdSeed token setting via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
PLUGIN
Birdseed
CVE-2026-4071
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-2382 - Fpw Category Thumbnails Plugin
The FPW Category Thumbnails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'fpw_fs_get_file' AJAX action in all versions up to, and including, 1.9.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the plugin's settings page.
PLUGIN
Fpw Category Thumbnails
CVE-2026-2382
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-2425 - Hiweb Migration Simple Plugin
The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_domain' parameter in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
PLUGIN
Hiweb Migration Simple
CVE-2026-2425
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-1451 - Rognone Plugin
The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'a' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Rognone
CVE-2026-1451
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-1450 - Rognone Plugin
The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Rognone
CVE-2026-1450
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-8293 - Really Simple Security Plugin
The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.
PLUGIN
Really Simple Security
CVE-2026-8293
Risk Score
Threat Entry
Updated 2026-07-22
CVE-2026-8206 - Kirki – Freeform Page Builder, Website Builder & Customizer Theme
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered on the site to their own email address.
THEME
Kirki – Freeform Page Builder, Website Builder & Customizer
CVE-2026-8206
Risk Score