Threat Database (40,783)

Threat Entry Updated 2026-10-06

Woorechnung - Security Vulnerability (CVE-2026-32576)

Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2.

PLUGIN Woorechnung

CVE-2026-32576

MEDIUM CVSS 6.5 2026-10-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Wds Mcp Content Manager - Security Vulnerability (CVE-2026-39599)

Contributor Broken Access Control in WDS MCP Content Manager

PLUGIN Wds Mcp Content Manager

CVE-2026-39599

MEDIUM CVSS 4.3 2026-10-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Fluent Booking Pro - Security Vulnerability (CVE-2026-105072)

Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.

PLUGIN Fluent Booking Pro

CVE-2026-105072

HIGH CVSS 7.5 2026-10-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Simple Event Planner - Security Vulnerability (CVE-2026-97257)

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.

PLUGIN Simple Event Planner

CVE-2026-97257

HIGH CVSS 8.8 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Sunshine Photo Cart - Security Vulnerability (CVE-2026-93617)

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.

PLUGIN Sunshine Photo Cart

CVE-2026-93617

HIGH CVSS 7.2 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Wp Base Booking Of Appointments Services And Events - Security Vulnerability (CVE-2026-103066)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.

PLUGIN Wp Base Booking Of Appointments Services And Events

CVE-2026-103066

HIGH CVSS 8.5 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Wp Ultimate Exporter - Security Vulnerability (CVE-2026-103348)

Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0.

PLUGIN Wp Ultimate Exporter

CVE-2026-103348

HIGH CVSS 7.2 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Wc Ukr Shipping - Security Vulnerability (CVE-2026-103337)

Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.

PLUGIN Wc Ukr Shipping

CVE-2026-103337

MEDIUM CVSS 6.5 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Vk Google Job Posting Manager - Security Vulnerability (CVE-2026-100511)

Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.

PLUGIN Vk Google Job Posting Manager

CVE-2026-100511

HIGH CVSS 8.8 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Wp Spell Check - Security Vulnerability (CVE-2026-100506)

Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1.

PLUGIN Wp Spell Check

CVE-2026-100506

HIGH CVSS 7.2 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Advanced Post Manager - Security Vulnerability (CVE-2026-97283)

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.

PLUGIN Advanced Post Manager

CVE-2026-97283

CRITICAL CVSS 9.8 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Scratch Win Giveaways For Website Facebook - Security Vulnerability (CVE-2026-97303)

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2.

PLUGIN Scratch Win Giveaways For Website Facebook

CVE-2026-97303

HIGH CVSS 7.6 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Computer Repair Shop - Security Vulnerability (CVE-2026-97309)

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.

PLUGIN Computer Repair Shop

CVE-2026-97309

HIGH CVSS 7.1 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Hyve Lite - Security Vulnerability (CVE-2026-97305)

Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a through 2.0.2.

PLUGIN Hyve Lite

CVE-2026-97305

MEDIUM CVSS 6.9 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Timetics - Security Vulnerability (CVE-2026-97304)

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.

PLUGIN Timetics

CVE-2026-97304

MEDIUM CVSS 6.5 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Cozy Addons - Security Vulnerability (CVE-2026-97070)

Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.

PLUGIN Cozy Addons

CVE-2026-97070

MEDIUM CVSS 6.9 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Woo Product Builder - Security Vulnerability (CVE-2026-97275)

Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Input Data Manipulation.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

PLUGIN Woo Product Builder

CVE-2026-97275

MEDIUM CVSS 5.3 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Wp Base Booking Of Appointments Services And Events - Security Vulnerability (CVE-2026-103352)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.

PLUGIN Wp Base Booking Of Appointments Services And Events

CVE-2026-103352

CRITICAL CVSS 9.3 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Restaurant Reservations - Security Vulnerability (CVE-2026-103334)

Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24.

PLUGIN Restaurant Reservations

CVE-2026-103334

HIGH CVSS 7.5 2026-10-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-06

Woo Product Feed Pro - Security Vulnerability (CVE-2026-103349)

Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Object Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5.7.

PLUGIN Woo Product Feed Pro

CVE-2026-103349

HIGH CVSS 7.2 2026-10-05

Risk Score

Open Full Technical Breakdown