CVEs
Browse the synced catalog, newest first.
- CVE-2026-122231WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Valuewestguard WS Form LITE – Drag & Drop Contact Form Builder
- CVE-2026-120685Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chainshapedplugin Real Testimonials – Testimonial Slider, Collec…
- CVE-2026-109230WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameterosamaesh WP Visitor Statistics
- CVE-2026-93766Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' ParameterHappyforms Pro
- CVE-2026-119075Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkoutthemegrill Registration Form for WooCommerce
- CVE-2026-104746Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Metastylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2026-104768AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Optionrubengc AutomatorWP – No-Code Workflow Automation, Integrat…
- CVE-2026-120683Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parametershapedplugin Real Testimonials – Testimonial Slider, Collec…
- CVE-2026-104760weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site…wedevs weDocs: AI Powered Knowledge Base, Docs, Documentati…
- CVE-2026-103914Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameterwpvibes Dynific Addons for Elementor
- CVE-2026-119183JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Metajetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-96565WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout…cbutlerjr WP-Members Membership Plugin
- CVE-2026-116751Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array KeysBooking for Appointments and Events Calendar – Amelia Pro
- CVE-2026-118066Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in…Appointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-122059WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attributempol WP ImageViewer
- CVE-2026-118056Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored…oxilab Image Hover Effects Ultimate
- CVE-2026-118047Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via…sbouey Falang multilanguage for WordPress
- CVE-2026-116537Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameterjackdewey Link Library
- CVE-2026-93755Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via Client-IP/X-Forwarded-For HeaderHappyforms Pro
- CVE-2026-102564Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content…wpvibes Dynific Addons for Elementor
- CVE-2026-121265SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and updateSQL-Abstract
- CVE-2026-121571WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerabilityWP Desk Autopay dla WooCommerce
- CVE-2026-119496WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-123470WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerabilityHivePress
- CVE-2026-119513WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerabilityAhmad JS Help Desk
- CVE-2026-123468WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerabilityStylemixThemes Motors
- CVE-2026-120857WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerabilityVideoWhisper.com 2Way VideoCalls and Random Chat
- CVE-2026-123148WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerabilityTMS IvyForms
- CVE-2026-120837WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerabilityEverest Forms
- CVE-2026-121724WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerabilityWebberZone Contextual Related Posts