Threat database

1,404 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.5	EPSS 0.2%	CVE-2026-100513CF7 Views – Complete Entry Management for Contact Form 7 (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100513 Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions. EPSS 0.2%Vulnerability Aman CWE-79	CVE Database V5	2026-09-30
Medium	5.3	EPSS 0.3%	CVE-2026-100508Two Factor (WordPress plugin) · Unthrottled Resource Allocation Medium5.3EPSS 0.3%2026-09-30CVE Database V5CVE-2026-100508 Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. EPSS 0.3%Vulnerability WordPress.org CWE-770	CVE Database V5	2026-09-30
High	7.1	EPSS 0.2%	CVE-2026-100507If-So Dynamic Content Personalization (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-09-30CVE Database V5CVE-2026-100507 CVE-2026-100507 is a high-severity reflected Cross-site Scripting (XSS) vulnerability in If-So Dynamic Content Personalization affecting versions from initial through 1.10.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-09-30
Medium	5.3	EPSS 0.2%	CVE-2026-97302MPG (WordPress plugin) · Insertion of Sensitive Information Into Sent Data Medium5.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97302 Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. EPSS 0.2%Vulnerability Themeisle CWE-201	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.2%	CVE-2026-97301Cool Formkit Lite (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97301 Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. EPSS 0.2%Vulnerability Cool Plugins CWE-79	CVE Database V5	2026-09-30
Medium	5.4	EPSS <0.1%	CVE-2026-97299Razorpay Payment Links for WooCommerce (WordPress plugin) · Cross-Site Request Forgery (CSRF) Medium5.4EPSS <0.1%2026-09-30CVE Database V5CVE-2026-97299 Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions. EPSS <0.1%Vulnerability KnitPay CWE-352	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.1%	CVE-2026-97298King Addons for Elementor (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97298 Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions. EPSS 0.1%Vulnerability KingAddons CWE-79	CVE Database V5	2026-09-30
High	8.5	EPSS 0.2%	CVE-2026-97293Media LIbrary Assistant (WordPress plugin) · SQL Injection High8.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97293 Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. EPSS 0.2%Vulnerability David Lingren CWE-89	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.1%	CVE-2026-97292YITH WooCommerce Tab Manager (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97292 Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. EPSS 0.1%Vulnerability YITHEMES CWE-79	CVE Database V5	2026-09-30
High	7.1	EPSS 0.1%	CVE-2026-97289Quiz And Survey Master (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97289 CVE-2026-97289 is a high-severity cross-site scripting (XSS) vulnerability in the ExpressTech Quiz And Survey Master plugin, affecting versions from initial release up to 11.2.6. The vulnerability involves improper neutralization of input during web page generation, leading to DOM-based XSS. This can allow an attacker to execute arbitrary scripts in the context of the affected web application. The vulnerability has a CVSS 3.1 score of 7.1, indicating a significant risk. No official patch or remediation details are provided in the available data. EPSS 0.1%Vulnerability ExpressTech CWE-79	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.1%	CVE-2026-97288OAuth Server (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97288 Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. EPSS 0.1%Vulnerability Jayson T Cote CWE-79	CVE Database V5	2026-09-30
High	8.5	EPSS 0.3%	CVE-2026-97287Event Tickets (WordPress plugin) · SQL Injection High8.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-97287 CVE-2026-97287 is a high-severity SQL Injection vulnerability in Liquid Web / StellarWP Event Tickets plugin. It allows Blind SQL Injection due to improper neutralization of special elements in SQL commands. The issue affects versions from the initial release up to 5.29.5. No official patch or remediation details are provided in the available data. EPSS 0.3%Vulnerability Liquid Web / StellarWP CWE-89	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.2%	CVE-2026-97286Strong Testimonials (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97286 A stored cross-site scripting (XSS) vulnerability exists in WP Chill Strong Testimonials plugin versions before 3.3.12. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the context of the affected web application. EPSS 0.2%Vulnerability WP Chill CWE-79	CVE Database V5	2026-09-30
Medium	5.4	EPSS 0.2%	CVE-2026-97285The Events Calendar (WordPress plugin) · Missing Authorization Medium5.4EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97285 Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. EPSS 0.2%Vulnerability Nexcess CWE-862	CVE Database V5	2026-09-30
Medium	5.3	EPSS 0.2%	CVE-2026-97282Review Schema (WordPress plugin) · Insecure Direct Object Reference Medium5.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97282 Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions. EPSS 0.2%Vulnerability RadiusTheme CWE-639	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.1%	CVE-2026-97279Polylang (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97279 Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. EPSS 0.1%Vulnerability Chouby CWE-79	CVE Database V5	2026-09-30
Critical	9.8	EPSS 0.3%	CVE-2026-97274OAuth Single Sign On (WordPress plugin) · Authentication Bypass by Spoofing Critical9.8EPSS 0.3%2026-09-30CVE Database V5CVE-2026-97274 Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions. EPSS 0.3%Vulnerability miniOrange CWE-290	CVE Database V5	2026-09-30
High	7.1	EPSS 0.1%	CVE-2026-97272Premmerce Permalink Manager for WooCommerce (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97272 Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions. EPSS 0.1%Vulnerability CWE-79	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.2%	CVE-2026-97270CMB2 (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97270 Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. EPSS 0.2%Vulnerability Justin Sternberg CWE-79	CVE Database V5	2026-09-30
Medium	4.3	EPSS 0.2%	CVE-2026-97267Prevent files / folders access (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97267 Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions. EPSS 0.2%Vulnerability miniOrange CWE-862	CVE Database V5	2026-09-30

Page 22 of 72