Unknown vulnerabilities
6,074 vulnerabilities
Known vulnerabilities in Unknown products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3,704 products.
Products
50 of 3,704- Moodle22 vulnerabilities
- Contest Gallery20 vulnerabilities
- Salon Booking System20 vulnerabilities
- Masterstudy LMS Wordpress Plugin19 vulnerabilities
- Download Manager18 vulnerabilities
- Eventin18 vulnerabilities
- Contest Gallery Pro17 vulnerabilities
- Learnpress17 vulnerabilities
- Tutor LMS17 vulnerabilities
- Kirki15 vulnerabilities
- Modern Events Calendar Lite15 vulnerabilities
- Quiz And Survey Master (Qsm)14 vulnerabilities
- User Registration & Membership14 vulnerabilities
- AI Engine13 vulnerabilities
- Eventon13 vulnerabilities
- Kernel13 vulnerabilities
- Welcart E Commerce13 vulnerabilities
- WP Directory Kit13 vulnerabilities
- Frontend File Manager Plugin12 vulnerabilities
- Jenkins12 vulnerabilities
- Mstore API12 vulnerabilities
- Rank Math SEO12 vulnerabilities
- Simple Membership12 vulnerabilities
- Easy Appointments11 vulnerabilities
- Ninja Forms11 vulnerabilities
- Registrationmagic11 vulnerabilities
- The Events Calendar11 vulnerabilities
- Tutor LMS – Elearning And Online Course Solution11 vulnerabilities
- AI Chatbot10 vulnerabilities
- Elementor Website Builder10 vulnerabilities
- Form Maker By 10Web10 vulnerabilities
- Forminator Forms10 vulnerabilities
- Kivicare10 vulnerabilities
- Logo Slider10 vulnerabilities
- Masteriyo LMS10 vulnerabilities
- Passster10 vulnerabilities
- WP Import Export Lite10 vulnerabilities
- Wp Emember10 vulnerabilities
- Booking For Appointments And Events Calendar9 vulnerabilities
- Embedpress9 vulnerabilities
- Link Library9 vulnerabilities
- Ninja Forms Contact Form – The Drag And Drop Form Builder For Wordpress9 vulnerabilities
- Patreon Wordpress9 vulnerabilities
- Photo Gallery By 10Web9 vulnerabilities
- Popup Box9 vulnerabilities
- Samba9 vulnerabilities
- WP Photo Album Plus9 vulnerabilities
- Wpematico RSS Feed Fetcher9 vulnerabilities
- Autoptimize8 vulnerabilities
- Booster For Woocommerce8 vulnerabilities
CVE-2026-96534unknownmodern event calendar pro+1
EPSS score0.16%
The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.CVE-2026-87844unknownpickplugins product designer for woocommerceEPSS score0.14%
The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.CVE-2026-111041unknownai engineEPSS score0.13%
The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object, allowing users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.CVE-2026-110981unknownwp photo album plusEPSS score0.17%
The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links, allowing unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.CVE-2026-110976unknownai engineEPSS score0.13%
The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it, allowing users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.CVE-2026-110070unknownmodern events calendar liteEPSS score0.13%
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.CVE-2026-110069unknownmodern events calendar liteEPSS score0.14%
The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data, allowing any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.CVE-2026-110035unknownsalon booking systemEPSS score0.13%
The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.CVE-2026-110033unknownsalon booking systemEPSS score0.15%
The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename, allowing users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.CVE-2026-110032unknownsalon booking systemEPSS score0.13%
The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen, allowing users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account, leading to loss of administrative access and potential site lockout.CVE-2026-110031unknownsalon booking systemEPSS score0.13%
The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer, allowing them to escalate any account to administrator and take over the site.CVE-2026-110026unknowntasty recipes liteEPSS score0.13%
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.CVE-2026-109937unknownotter blocksEPSS score0.14%
The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session, allowing unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.CVE-2026-97314unknownthirstyaffiliatesEPSS score0.14%
The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthenticated attackers to disclose the destination URLs of unpublished affiliate links and to record fabricated click statistics.CVE-2026-92433unknownpatreon wordpressEPSS score0.11%
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request (CSRF), taking over the site's Patreon integration.CVE-2026-92432unknownpatreon wordpressEPSS score0.14%
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing.CVE-2026-92431unknownpatreon wordpressEPSS score0.14%
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end.CVE-2026-91074unknownbsk pdf managerEPSS score0.16%
The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the database.CVE-2026-81344unknownacf frontend admin by dynamiappsEPSS score0.20%
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content that is rendered on public-facing pages, allowing high-privilege users such as administrators to inject a PHP object which, given a suitable POP chain in another installed ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 or in WordPress core, can be leveraged to achieve remote code execution.CVE-2026-81343unknownacf frontend admin by dynamiappsEPSS score0.13%
The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitted values into the site's global ACF options store, allowing unauthenticated visitors to overwrite site-wide option values via a public form.