Browse CVEs

HIGH 8.1 CVE-2026-16144 The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includin… No fix yet Fix from $1,9502026-08-01 MEDIUM 6.4 CVE-2026-16091 The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Si… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-16090 The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Si… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.5 CVE-2026-16087 The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Par… No fix yet Fix from $1,6002026-08-01 CRITICAL 9.8 CVE-2026-15964 The Single Sign On For TNG plugin for WordPress is vulnerable to Authentication Bypass via unauthenticated password reset in all versions up to, and … No fix yet Fix from $2,3002026-08-01 MEDIUM 6.4 CVE-2026-15950 The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cros… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-15662 The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-15649 The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all vers… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-15645 The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-15644 The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in a… No fix yet Fix from $1,6002026-08-01 HIGH 8.1 CVE-2026-15450 The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and … No fix yet Fix from $1,9502026-08-01 HIGH 7.2 CVE-2026-15052 The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form F… No fix yet Fix from $1,9502026-08-01 MEDIUM 5.3 CVE-2026-15018 The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versio… No fix yet Fix from $1,6002026-08-01 MEDIUM 6.4 CVE-2026-13458 The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up … No fix yet Fix from $1,6002026-08-01 MEDIUM 5.3 CVE-2026-11995 The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorizatio… No fix yet Fix from $1,6002026-08-01 MEDIUM 5.3 CVE-2025-14073 The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in … No fix yet Fix from $1,6002026-08-01 HIGH 8.8 CVE-2026-15988 The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,… No fix yet Fix from $1,9502026-08-01 MEDIUM 5.3 CVE-2026-15932 The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthentica… No fix yet Fix from $1,6002026-08-01 HIGH 8.1 CVE-2026-15368 The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly c… No fix yet Fix from $1,9502026-08-01 HIGH 7.2 CVE-2026-15244 The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inc… No fix yet Fix from $1,9502026-08-01 MEDIUM 5.3 CVE-2026-14840 The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding heade… No fix yet Fix from $1,6002026-08-01 MEDIUM 5.4 CVE-2026-15262 The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress… No fix yet Fix from $1,6002026-08-01 MEDIUM 5.4 CVE-2026-15234 The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when… No fix yet Fix from $1,6002026-08-01 HIGH 8.1 CVE-2026-14836 The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keyi… No fix yet Fix from $1,9502026-08-01 MEDIUM 5.3 CVE-2026-14822 The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endp… No fix yet Fix from $1,6002026-08-01 HIGH 8.8 CVE-2026-14596 The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset l… No fix yet Fix from $1,9502026-08-01 HIGH 8.1 CVE-2026-14309 The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a… No fix yet Fix from $1,9502026-08-01 HIGH 7.5 CVE-2026-14839 The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauth… No fix yet Fix from $1,9502026-08-01 MEDIUM 6.5 CVE-2026-14561 The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and … No fix yet Fix from $1,6002026-08-01 MEDIUM 6.5 CVE-2026-14315 The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing una… No fix yet Fix from $1,6002026-08-01