Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-06
Js Support Ticket - Security Vulnerability (CVE-2026-103078)
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
PLUGIN
Js Support Ticket
CVE-2026-103078
Risk Score
Threat Entry
Updated 2026-10-06
Astra Sites - Security Vulnerability (CVE-2026-102393)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7.
PLUGIN
Astra Sites
CVE-2026-102393
Risk Score
Threat Entry
Updated 2026-10-06
UPI QR Code Payment Gateway - Security Vulnerability (CVE-2026-84169)
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.
PLUGIN
UPI QR Code Payment Gateway
CVE-2026-84169
Risk Score
Threat Entry
Updated 2026-10-06
File Uploads Addon for WooCommerce - Security Vulnerability (CVE-2026-78371)
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.
PLUGIN
File Uploads Addon for WooCommerce
CVE-2026-78371
Risk Score
Threat Entry
Updated 2026-10-06
File Uploads Addon for WooCommerce - Security Vulnerability (CVE-2026-13607)
The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the File Uploads Addon for WooCommerce WordPress plugin through 1.7.6's authenticated download mechanism.
PLUGIN
File Uploads Addon for WooCommerce
CVE-2026-13607
Risk Score
Threat Entry
Updated 2026-10-06
Mindio Magic Mcp - Security Vulnerability (CVE-2026-104402)
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
PLUGIN
Mindio Magic Mcp
CVE-2026-104402
Risk Score
Threat Entry
Updated 2026-10-06
Cost Calculator Builder - Security Vulnerability (CVE-2026-97307)
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
PLUGIN
Cost Calculator Builder
CVE-2026-97307
Risk Score
Threat Entry
Updated 2026-10-06
Wp Statistics - Security Vulnerability (CVE-2026-97276)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.14.
PLUGIN
Wp Statistics
CVE-2026-97276
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103355)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-103355
Risk Score
Threat Entry
Updated 2026-10-06
Kadence Blocks - Security Vulnerability (CVE-2026-103354)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.11.1.
PLUGIN
Kadence Blocks
CVE-2026-103354
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103344)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-103344
Risk Score
Threat Entry
Updated 2026-10-06
Translatepress Multilingual - Security Vulnerability (CVE-2026-103062)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
PLUGIN
Translatepress Multilingual
CVE-2026-103062
Risk Score
Threat Entry
Updated 2026-10-06
CoCart - Security Vulnerability (CVE-2026-93549)
The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a cross-site request forgery attack that creates a new administrator account using a logged-in administrator's session.
PLUGIN
CoCart
CVE-2026-93549
Risk Score
Threat Entry
Updated 2026-10-09
User Private Files - Security Vulnerability (CVE-2026-97332)
The User Private Files WordPress plugin before 2.2.0 does not properly protect its stored private files on multisite installations, where the rewrite rule it relies on to route file requests through its access check is never reached, allowing unauthenticated users to retrieve other users' private files directly.
PLUGIN
User Private Files
CVE-2026-97332
Risk Score
Threat Entry
Updated 2026-10-06
Five Star Business Profile and Schema - Security Vulnerability (CVE-2026-86817)
The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, allowing authenticated users with Author-level access and above to store input that discloses sensitive data, including other users' password hashes and arbitrary site option values, in public output readable by unauthenticated visitors.
PLUGIN
Five Star Business Profile and Schema
CVE-2026-86817
Risk Score
Threat Entry
Updated 2026-10-06
Horizontal scrolling announcements - Security Vulnerability (CVE-2026-17005)
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once permitted) to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the announcement.
PLUGIN
Horizontal scrolling announcements
CVE-2026-17005
Risk Score
Threat Entry
Updated 2026-10-06
Simple Shopping Cart - Security Vulnerability (CVE-2026-104119)
The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin settings page, allowing high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks, which is notably impactful on multisite installations where administrators do not have the unfiltered_html capability.
PLUGIN
Simple Shopping Cart
CVE-2026-104119
Risk Score
Threat Entry
Updated 2026-10-06
Razorpay for WooCommerce - Security Vulnerability (CVE-2026-104118)
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
PLUGIN
Razorpay for WooCommerce
CVE-2026-104118
Risk Score
Threat Entry
Updated 2026-10-06
Ultimate Member - Security Vulnerability (CVE-2026-96451)
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
PLUGIN
Ultimate Member
CVE-2026-96451
Risk Score
Threat Entry
Updated 2026-10-06
Unlimited Elements For Elementor - Security Vulnerability (CVE-2026-103342)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
PLUGIN
Unlimited Elements For Elementor
CVE-2026-103342
Risk Score