Unknown

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 3.7LowOct 29, 2026Unknown Contact Form by SupsysticCVE-2026-115303The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.
• –UnscoredOct 29, 2026Unknown vTables SQL injectionCVE-2026-89216The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.
• –UnscoredOct 29, 2026Unknown PAYCOMET for WooCommerce Auth bypass / access controlCVE-2026-88928The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card records.
• –UnscoredOct 29, 2026Unknown Community Events XSSCVE-2026-86794The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of an administrator reviewing the submission.
• –UnscoredOct 29, 2026Unknown Video Player for YouTube Auth bypass / access controlCVE-2026-85007The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.1 to modify and delete it as well.
• –UnscoredOct 29, 2026Unknown Link Library Information disclosureCVE-2026-78396The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.
• –UnscoredOct 29, 2026Unknown Link Library Auth bypass / access controlCVE-2026-78395The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.
• –UnscoredOct 29, 2026Unknown Contact Form by Supsystic Auth bypass / access controlCVE-2026-115302The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.
• –UnscoredOct 29, 2026Unknown Contact Form by Supsystic Code / command injectionCVE-2026-115301The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server. The injected template is compiled and executed whenever any visitor loads a page containing the form, so the stored payload also lets an unauthenticated visitor read server-side
• –UnscoredOct 29, 2026Unknown Contact Form by Supsystic CSRFCVE-2026-115300The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a logged-in administrator into sending a forged request.
• –UnscoredOct 29, 2026Unknown Contact Form by Supsystic CSRFCVE-2026-115299The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visiting a crafted page, which can route the Contact Form by Supsystic WordPress plugin before 1.11.1's contact-form notifications through infrastructure the attacker controls.
• –UnscoredOct 29, 2026Unknown Recipe Card Blocks Lite Information disclosureCVE-2026-115282The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ult
• –UnscoredOct 29, 2026Unknown Photo Engine (Media Organizer & Lightroom) Auth bypass / access controlCVE-2026-115259The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users.
• –UnscoredOct 29, 2026Unknown Chat AI with Dispatcher Path traversal / file handlingCVE-2026-115245The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution.
• –UnscoredOct 29, 2026Unknown GeoDirectory Information disclosureCVE-2026-114270The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
• –UnscoredOct 29, 2026Unknown Automated Import Products to Cart Path traversal / file handlingCVE-2026-113617The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones containing the database credentials) and delete arbitrary files on the server.
• –UnscoredOct 29, 2026Unknown LogixFast Auth Privilege escalationCVE-2026-113616The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
• –UnscoredOct 29, 2026Unknown Two Factor Authentication Auth bypass / access controlCVE-2026-111739The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own two-factor-enabled account to satisfy the victim's second-factor check with their own code and obtain the victim's session.
• –UnscoredOct 29, 2026Unknown WP Photo Album Plus CSRFCVE-2026-110983The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of its comment-management requests, allowing attackers to delete photo comments by tricking a logged-in user who holds comment-moderation rights into loading a crafted page.
• –UnscoredOct 29, 2026Unknown Enable SVG, WebP, and ICO Upload XSSCVE-2026-110505The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that execute in WebKit-based browsers such as Safari.
• –UnscoredOct 29, 2026Unknown Enable SVG, WebP, and ICO Upload XSSCVE-2026-110504The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
• –UnscoredOct 29, 2026Unknown Hide Price Until Login Auth bypass / access controlCVE-2026-110030The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.
• –UnscoredOct 29, 2026Unknown Wallet System for WooCommerce Auth bypass / access controlCVE-2026-108763The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Subscriber or Customer to overwrite the KYC documents and verification status of any other user, including an administrator.
• –UnscoredOct 29, 2026Unknown WP Post Author Information disclosureCVE-2026-108686The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
• –UnscoredOct 29, 2026Unknown WP Post Author Auth bypass / access controlCVE-2026-108685The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
• –UnscoredOct 29, 2026Unknown Appointment Booking Plugin XSSCVE-2026-105258The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
• –UnscoredOct 29, 2026Unknown Frontend Dashboard DeserializationCVE-2026-103693The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
• –UnscoredOct 29, 2026Unknown LetterPress XSSCVE-2024-3586The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
• 4.9MediumOct 28, 2026Unknown Smart Popup by Supsystic Code / command injectionCVE-2026-115223The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them, allowing an authenticated administrator to execute arbitrary template expressions server-side and read PHP constants such as the site's database credentials and authentication keys.
• 5.3MediumOct 28, 2026Unknown Essential Addons for Elementor Auth bypass / access controlCVE-2026-110508The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator approval requirement to accounts registered through its email one-time-password flow, which could allow unauthenticated users to register and log in without being approved by an administrator when both features are enabled.
• 5.3MediumOct 28, 2026Unknown Royal Elementor Addons Code / command injectionCVE-2026-106648The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from the site's own domain when a recipient field is configured to echo a submitted value.
• 5.3MediumOct 28, 2026Unknown Sadad QA Payment Auth bypass / access controlCVE-2026-103330The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the verification is keyed on a merchant secret that is empty by default and the rest of the signed data is attacker-controlled, allowing unauthenticated attackers to forge a valid confirmation and mark orders as paid without payment.
• 5.3MediumOct 28, 2026Unknown BitPay Gateway for WooCommerce Auth bypass / access controlCVE-2026-103313The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order it completes, nor verify the confirmed amount, allowing an unauthenticated attacker who holds a single genuine low-value transaction to mark arbitrary higher-value orders as paid.
• 6.8MediumOct 28, 2026Unknown Recipe Card Blocks Lite SQL injectionCVE-2026-115281The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.
• 5.3MediumOct 28, 2026Unknown WP Roster Auth bypass / access controlCVE-2026-115255The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.
• 5.8MediumOct 28, 2026Unknown Customer Engagement System SSRFCVE-2026-115225The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the API key supplied to it, allowing unauthenticated users to make the server open connections to arbitrary internal hosts and ports and infer from response timing which ones are reachable.
• 4.1MediumOct 28, 2026Unknown Customer Engagement System SQL injectionCVE-2026-115224The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category visibility rules, concatenating request-supplied ID values directly into an INSERT statement with no parameter binding or integer cast, allowing an authenticated administrator to inject arbitrary SQL and read the contents of the WordPress database.
• 6.5MediumOct 28, 2026Unknown PayPlug for WooCommerce (Official) Auth bypass / access controlCVE-2026-113813The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthenticated AJAX actions that operate on a caller-supplied order identifier, allowing unauthenticated attackers to modify, read the contents of, and permanently delete arbitrary WooCommerce orders.
• 2.7LowOct 28, 2026Unknown GeoDirectory Information disclosureCVE-2026-113494The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
• 6.8MediumOct 28, 2026Unknown GeoDirectory XSSCVE-2026-113488The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators.
• 6.8MediumOct 28, 2026Unknown GeoDirectory XSSCVE-2026-113487The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content.
• 6.5MediumOct 28, 2026Unknown Media Library Assistant CSRFCVE-2026-113486The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-site request can cause a logged-in user with the Editor role or above to permanently delete every trashed attachment on the site.
• 6.5MediumOct 28, 2026Unknown Media Library Assistant CSRFCVE-2026-113485The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF nonce on the Media Library bulk-action handler, checking the nonce only when its field is present, so a forged request that omits the field can cause a logged-in user with the Author role or above to trash or delete attachments.
• 6.8MediumOct 28, 2026Unknown MP3 Audio Player XSSCVE-2026-111967The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content.
• 3.8LowOct 28, 2026Unknown Royal MCP Auth bypass / access controlCVE-2026-111961The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without holding the publish capability.
• 4.3MediumOct 28, 2026Unknown Royal MCP Auth bypass / access controlCVE-2026-111960The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
• 7.2HighOct 28, 2026Unknown GoSMTP Privilege escalationCVE-2026-111577The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.
• 3.8LowOct 28, 2026Unknown Welcart e-Commerce Auth bypass / access controlCVE-2026-111032The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read, modify, create, delete and re-order the SKU data (including prices, confidential cost prices and stock levels) of any product, including those belonging to other users.
• 4.7MediumOct 28, 2026Unknown Welcart e-CommerceCVE-2026-111031The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites.
• 6.8MediumOct 28, 2026Unknown Welcart e-Commerce SQL injectionCVE-2026-111027The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parameter before using it in a SQL query, and strips the escaping it had applied before running the query, allowing users with the Editor role or higher to perform SQL injection attacks.

See every Unknown entry on the dashboard.

Top products

• GeoDirectory11 CVEs in the last year
• Contact Form by Supsystic6 CVEs in the last year
• GiveWP5 CVEs in the last year
• WPVR4 CVEs in the last year
• Royal Addons for Elementor4 CVEs in the last year
• Otter Blocks4 CVEs in the last year
• Essential Addons for Elementor4 CVEs in the last year
• Advanced Custom Fields: Extended4 CVEs in the last year, 1 critical
• Welcart e-Commerce3 CVEs in the last year
• Media Library Assistant3 CVEs in the last year

Time to weaponize

Same definitions as the Threats tab, limited to this vendor.