CVEs
Browse the synced catalog, newest first.
- CVE-2026-121870Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login TokenSimpler Checkout
- CVE-2026-121863Knowledge Building < 0.7.3 - Reflected XSS via Comment Reply ResponseKnowledge Building
- CVE-2026-121862Knowledge Building < 0.7.3 - Unauthenticated Stored XSS via knbu_new_reply AJAX ActionKnowledge Building
- CVE-2026-121497Askany < 2.2.0 - Unauthenticated Arbitrary File UploadAskAny
- CVE-2026-121472AutomatorWP < 6.0.8 - Zoom/AWeber Integration Connection Hijack via CSRFAutomatorWP
- CVE-2026-119531Live Composer < 2.1.24 - Contributor+ Stored XSS via Module Area ShortcodeLive Composer
- CVE-2026-119529Gravity Forms < 3.2.2 - Unauthenticated LFI via Chunked File UploadGravity Forms
- CVE-2026-119303NotificationX < 3.3.7 - Unauthenticated Settings Update and Email Sending via send-rating REST RouteNotificationX
- CVE-2026-119035Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty PrintSchema & Structured Data for WP & AMP
- CVE-2026-119034Schema & Structured Data for WP & AMP < 1.70 - Unauthenticated Non-Public Comment Disclosure via Review FilterSchema & Structured Data for WP & AMP
- CVE-2026-119033Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Structured Data Modification of Other Users' Posts via IDORSchema & Structured Data for WP & AMP
- CVE-2026-119032Schema & Structured Data for WP & AMP < 1.70 - Authenticated Arbitrary Post Modification via Backup ImportSchema & Structured Data for WP & AMP
- CVE-2026-118439Limit Login Attempts Reloaded < 3.4.2 - Admin+ SSRF via App Setup CodeLimit Login Attempts Security
- CVE-2026-118420WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'main_field' ParameterWP Directory Kit
- CVE-2026-118418WP Directory Kit < 1.6.3 - Unauthenticated User Data and Contact Message DisclosureWP Directory Kit
- CVE-2026-118241Smush < 4.3.6 - Author+ Optimization and Restoration of Others' Attachments via IDORSmush
- CVE-2026-118041Contest Gallery < 34.0.3 - Author+ Arbitrary File Upload via Ecommerce Sale File ReplacementContest Gallery
- CVE-2026-117524Dynific Addons for Elementor 1.3 - Contributor+ Arbitrary Post Content Disclosure via dynific_template ShortcodeDynific Addons for Elementor
- CVE-2026-117523Dynific Addons for Elementor < 1.3.1 - Subscriber+ Module Settings Update via aep_module AJAX ActionDynific Addons for Elementor
- CVE-2026-117522Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Post Title in Post Image WidgetDynific Addons for Elementor
- CVE-2026-117521Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Display Name in Post Author WidgetDynific Addons for Elementor
- CVE-2026-115735Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File DeletionSomatic Framework
- CVE-2026-115734Pay With a Tweet <= 1.0.5 - Subscriber+ Arbitrary File Deletion via Button Download PathPay with a tweet
- CVE-2026-115733PrintAura WooCommerce API <= 4.0.2 - Unauthenticated WooCommerce REST API Authentication BypassPrintaura-Woocommerce
- CVE-2026-111597Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Disclosure of Post-Payment Redirect URL and Thank-You Message via Unpaid Stripe…Forminator Forms
- CVE-2026-111579Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway UnavailableForminator Forms
- CVE-2026-110949Download Manager (Free & Pro) - Unauthenticated Missing Authorization via Password ValidationDownload Manager
- CVE-2026-110948Download Manager (Free & Pro) - Unauthenticated Protected File Download via Media Preview Download KeyDownload Manager
- CVE-2026-110016Data Tables Generator by Supsystic < 1.15.8 - Unauthenticated Table Content Disclosure via IDORData Tables Generator by Supsystic
- CVE-2026-109873User Registration & Membership < 5.3.2 - Unauthenticated Payment Before Login Bypass via Omitted Membership FieldUser Registration & Membership