Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,868

CVE-2026-11976

MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Monsterinsights
Products
Monsterinsights
CVE-2026-11361

Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Formidableforms Wordpress
Products
Formidable Wordpress
CVE-2026-13399

Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Payment Plugins Wordpress
Products
Payment Plugins For Paypal Woocommerce Wordpress
CVE-2026-14936

Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Simple-membership-plugin Wordpress
Products
Simple Membership Wordpress
CVE-2026-12801

Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Themefic Wordpress
Products
Ultimate Addons For Contact Form 7 Wordpress
CVE-2026-14364

TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid'

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to account takeover via improper password reset validation in all versions up to, and including, 1.2.3. This is due to the plugin not properly validating a user's identity before resetting their password. This makes it possible for unauthenticated attackers to reset the password of arbitrary user accounts, including administrators, and gain access to those accounts.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Themetechmount Wordpress
Products
Truebooker-appointment-booking Wordpress
CVE-2026-14205

WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter

The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp-eventmanager
Products
Wordpress Wp Event Manager
CVE-2026-14331

Subscribe2 < 10.46 - Reflected XSS via email Parameter

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Subscribe2 Project Wordpress
Products
Subscribe2 Wordpress
CVE-2026-15214

Subscriptions for WooCommerce < 2.0.1 - Subscriber+ Subscription Detail Disclosure via IDOR

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its details, allowing any authenticated customer to read another customer's subscription information (the subscribed product, status, and dates) by supplying that subscription's ID.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpswings
Products
Wordpress Subscriptions For Woocommerce
CVE-2026-15215

Subscriptions for WooCommerce < 2.0.1 - Shop Manager+ Arbitrary Plugin Installation

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) to install and activate arbitrary Subscriptions for WooCommerce WordPress plugin before 2.0.1, resulting in remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpswings
Products
Wordpress Subscriptions For Woocommerce
CVE-2026-15361

Content Views < 4.5 - Subscriber+ SQL Injection via preview_request

The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied data before using it in a SQL query, allowing any authenticated user, including Subscribers, to perform SQL injection attacks.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Contentviewspro Wordpress
Products
Content Views Wordpress
CVE-2026-16030

MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-16038

MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-16039

MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-16041

MStore API < 4.21.0 - Unauthenticated Product Review Creation

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-49006

TLS credential leakage vulnerability in ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zte
Products
F689
CVE-2026-15239

Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge token in its Forminator integration, instead keying it to an attacker-controlled, reusable request value, allowing unauthenticated attackers to solve one challenge and then replay token-less form submissions for a short window, defeating the anti-abuse protection the plugin provides.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Simple Captcha Wordpress
Products
Simple Captcha With Cloudflare Turnstile Wordpress
CVE-2026-49007

Information leakage vulnerability in ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Zte
Products
F689
CVE-2026-66493

Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Phoca
Products
Phoca Commander Extension For Joomla