Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-109147 | 7.1 high | 0.00% | no CPE yet | The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators. | 21 Oct |
| CVE-2026-111948 | 7.1 high | 0.00% | no CPE yet | The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users. | 21 Oct |
| CVE-2026-79627 | 7.1 high | 0.00% | no CPE yet | The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator. | 21 Oct |
| CVE-2026-110981 | 7.1 high | 0.00% | no CPE yet | The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator. | 19 Oct |
| CVE-2026-110384 | 7.1 high | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21. | 19 Oct |
| CVE-2025-11560 | 7.1 high | 0.00% | no CPE yet | The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins. | 19 Oct |
| CVE-2025-48353 | 7.1 high | 0.00% | no CPE yet | Cross-Site Request Forgery (CSRF) vulnerability in dactum Clickbank WordPress Plugin (Niche Storefront) clickbank-niche-storefronts allows Stored XSS.This issue affects Clickbank WordPress Plugin (Niche Storefront): from n/a through <= 1.3.5. | 18 Oct |
| CVE-2025-12411 | 7.1 high | 0.00% | no CPE yet | The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1.1.10. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber level access and above, to manipulate SQL queries that can be used to extract sensitive information from the database and modify price type display names in the database via the admin-post.php "premmerce_update_price_type" action, causing cosmetic corruption of the admin interface. The 'price_type' parameter of the "premmerce_delete_price_type" is also vulnerable. | 18 Oct |
| CVE-2026-108695 | 7.1 high | 0.00% | no CPE yet | MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings via the settings REST endpoint. Attackers with the store_owner role can send POST requests to /wp-json/multivendorx/v1/settings, gated only by edit_stores, to overwrite commission, payout, and onboarding settings. | 16 Oct |
| CVE-2026-74920 | 7.1 high | 0.00% | no CPE yet | The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator. | 15 Oct |
| CVE-2025-15697 | 7.1 high | 0.00% | no CPE yet | The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request. | 14 Oct |
| CVE-2026-91829 | 7.1 high | 0.00% | no CPE yet | The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators. | 13 Oct |
| CVE-2026-57806 | 7.1 high | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9. | 13 Oct |
| CVE-2025-49953 | 7.1 high | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeinity ShareBang, Ultimate Social Share Buttons for WordPress sharebang allows Reflected XSS.This issue affects ShareBang, Ultimate Social Share Buttons for WordPress: from n/a through <= 1.4. | 8 Oct |
| CVE-2025-53420 | 7.1 high | 0.00% | vibethemes, wordpress_learning_management_system | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8. | 8 Oct |
| CVE-2025-53422 | 7.1 high | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeWarriors WhatsApp Chat for WordPress and WooCommerce tw-whatsapp-chat-rotator allows Reflected XSS.This issue affects WhatsApp Chat for WordPress and WooCommerce: from n/a through <= 1.2.1. | 8 Oct |
| CVE-2025-60075 | 7.1 high | 0.00% | no CPE yet | Cross-Site Request Forgery (CSRF) vulnerability in Allegro Marketing hpb seo plugin for WordPress hpbseo allows Reflected XSS.This issue affects hpb seo plugin for WordPress: from n/a through <= 3.0.1. | 8 Oct |
| CVE-2025-12629 | 7.1 high | 0.00% | no CPE yet | The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | 8 Oct |
| CVE-2026-119714 | 6.9 medium | 0.00% | joedolson, my calendar - accessible event manager | My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() in src/my-calendar-search.php without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing. | Fri 30 Oct |
| CVE-2026-112348 | 6.9 medium | 0.00% | themeum, kirki | Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation. | Fri 30 Oct |
| CVE-2026-65051 | 6.9 medium | 0.00% | no CPE yet | Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content. | 24 Oct |
| CVE-2026-115281 | 6.8 medium | 0.00% | no CPE yet | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks. | Wed 28 Oct |
| CVE-2026-113488 | 6.8 medium | 0.00% | no CPE yet | The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators. | Wed 28 Oct |
| CVE-2026-113487 | 6.8 medium | 0.00% | no CPE yet | The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content. | Wed 28 Oct |
| CVE-2026-111967 | 6.8 medium | 0.00% | no CPE yet | The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content. | Wed 28 Oct |
| CVE-2026-111027 | 6.8 medium | 0.00% | no CPE yet | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks. | Wed 28 Oct |
| CVE-2026-110524 | 6.8 medium | 0.00% | no CPE yet | The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content. | Wed 28 Oct |
| CVE-2026-110506 | 6.8 medium | 0.00% | no CPE yet | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor. | Wed 28 Oct |
| CVE-2026-107098 | 6.8 medium | 0.00% | no CPE yet | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission. | Wed 28 Oct |
| CVE-2026-104694 | 6.8 medium | 0.00% | no CPE yet | The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL query, allowing authenticated attackers with editor-level access to perform blind SQL injection attacks. | Wed 28 Oct |
| CVE-2026-105199 | 6.8 medium | 0.00% | no CPE yet | The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators. | Mon 26 Oct |
| CVE-2026-113493 | 6.8 medium | 0.00% | no CPE yet | The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content. | Mon 26 Oct |
| CVE-2026-114429 | 6.8 medium | 0.00% | no CPE yet | The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour. | Mon 26 Oct |
| CVE-2026-111979 | 6.8 medium | 0.00% | no CPE yet | The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form. | Mon 26 Oct |
| CVE-2026-109933 | 6.8 medium | 0.00% | no CPE yet | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including administrators, views the affected post. | 23 Oct |
| CVE-2026-111966 | 6.8 medium | 0.00% | no CPE yet | The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form. | 23 Oct |
| CVE-2026-94264 | 6.8 medium | 0.00% | no CPE yet | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes. | 23 Oct |
| CVE-2026-18202 | 6.8 medium | 0.00% | no CPE yet | The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross-Site Scripting). On multisite, this also overrides an upload-type restriction set by the network administrator. | 22 Oct |
| CVE-2026-111971 | 6.8 medium | 0.00% | no CPE yet | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names before storing them and outputting them in an administrative dashboard, allowing authenticated users with the author role and above to perform Stored Cross-Site Scripting attacks. | 22 Oct |
| CVE-2026-78392 | 6.8 medium | 0.00% | no CPE yet | The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link preview, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. The preview is generated without authentication and without checking whether the link has been published, so an unapproved submission is enough to reach any visitor who opens it. | 22 Oct |
| CVE-2026-107790 | 6.8 medium | 0.00% | no CPE yet | The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator. | 21 Oct |
| CVE-2026-110651 | 6.8 medium | 0.00% | no CPE yet | The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks. | 21 Oct |
| CVE-2026-81813 | 6.8 medium | 0.00% | no CPE yet | The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected. | 21 Oct |
| CVE-2025-14123 | 6.8 medium | 0.00% | no CPE yet | The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set an arbitrary role (e.g., Administrator) when performing a profile update if a plugin or theme using this framework has added at least one user profile field that leverages Redux_Users::set_profile/set_section/set_field. | 19 Oct |
| CVE-2025-15663 | 6.8 medium | 0.00% | no CPE yet | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider. | 19 Oct |
| CVE-2025-15664 | 6.8 medium | 0.00% | no CPE yet | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider. | 19 Oct |
| CVE-2025-15690 | 6.8 medium | 0.00% | no CPE yet | The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewing the affected page. The Content Mask WordPress plugin before 1.8.5.6's option to restrict its use by role does not prevent this. | 19 Oct |
| CVE-2026-91074 | 6.8 medium | 0.00% | no CPE yet | The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the database. | 19 Oct |
| CVE-2026-110033 | 6.8 medium | 0.00% | no CPE yet | The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it. | 19 Oct |
| CVE-2026-106933 | 6.8 medium | 0.00% | no CPE yet | The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file. | 19 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-31. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.