Threat database

1,404 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	6.5	EPSS 0.1%	CVE-2026-97266Virtue/Ascend/Pinnacle Toolkit (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97266 Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. EPSS 0.1%Vulnerability Nexcess CWE-79	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.1%	CVE-2026-97262Visual Composer Website Builder (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97262 Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. EPSS 0.1%Vulnerability CWE-79	CVE Database V5	2026-09-30
Medium	5.3	EPSS 0.2%	CVE-2026-97261Notivo (WordPress plugin) · Insertion of Sensitive Information Into Sent Data Medium5.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97261 Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. EPSS 0.2%Vulnerability VillaTheme CWE-201	CVE Database V5	2026-09-30
High	7.1	EPSS 0.1%	CVE-2026-97253LayerSlider (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97253 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0. EPSS 0.1%Vulnerability Kreatura CWE-79	CVE Database V5	2026-09-30
High	7.1	EPSS 0.1%	CVE-2026-97250Geo Mashup (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.1%2026-09-30CVE Database V5CVE-2026-97250 Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. EPSS 0.1%Vulnerability Dylan Kuhn CWE-79	CVE Database V5	2026-09-30
Medium	5.3	EPSS 0.2%	CVE-2026-97249Paid Member Subscriptions (WordPress plugin) · Authentication Bypass by Spoofing Medium5.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97249 Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions. EPSS 0.2%Vulnerability Cozmoslabs CWE-290	CVE Database V5	2026-09-30
Critical	9.8	EPSS 0.4%	CVE-2026-97248Booking Activities (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.4%2026-09-30CVE Database V5CVE-2026-97248 Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. EPSS 0.4%Vulnerability Booking Activities Team CWE-502	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.2%	CVE-2026-97247Blocksy Companion (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97247 Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. EPSS 0.2%Vulnerability Creative Themes CWE-862	CVE Database V5	2026-09-30
Medium	4.9	EPSS 0.2%	CVE-2026-97246ShortPixel Image Optimizer (WordPress plugin) · Deserialization of Untrusted Data Medium4.9EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97246 CVE-2026-97246 is a deserialization of untrusted data vulnerability in the ShortPixel Image Optimizer plugin for WordPress. It allows object injection, potentially leading to partial compromise of confidentiality and integrity. The issue affects versions from initial release up to 6.5.5. The vulnerability has a medium severity rating with a CVSS score of 4.9. No official patch or remediation details are provided in the available data. EPSS 0.2%Vulnerability CWE-502	CVE Database V5	2026-09-30
High	7.5	EPSS 0.3%	CVE-2026-97244Creator LMS (WordPress plugin) · Path Traversal: '.../...// High7.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-97244 Contributor Path Traversal in Creator LMS <= 1.2.19 versions. EPSS 0.3%Vulnerability WPFunnels CWE-35	CVE Database V5	2026-09-30
Medium	5.4	EPSS 0.2%	CVE-2026-97243AllAble Connector (WordPress plugin) · Missing Authorization Medium5.4EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97243 Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. EPSS 0.2%Vulnerability flexyma CWE-862	CVE Database V5	2026-09-30
Medium	6.8	EPSS 0.4%	CVE-2026-97242WEBO MCP (WordPress plugin) · Path Traversal Medium6.8EPSS 0.4%2026-09-30CVE Database V5CVE-2026-97242 Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions. EPSS 0.4%Vulnerability phuongwebo CWE-22	CVE Database V5	2026-09-30
High	7.5	EPSS 0.3%	CVE-2026-97241BackupEase (WordPress plugin) · Insertion of Sensitive Information Into Sent Data High7.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-97241 Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. EPSS 0.3%Vulnerability PrecisionWP CWE-201	CVE Database V5	2026-09-30
High	7.5	EPSS 0.3%	CVE-2026-97240StifLi Backup Tools (WordPress plugin) · Insertion of Sensitive Information Into Sent Data High7.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-97240 Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. EPSS 0.3%Vulnerability Esteban CWE-201	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.3%	CVE-2026-97239MCP Content Manager Lite (WordPress plugin) · Missing Authorization Medium6.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-97239 Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions. EPSS 0.3%Vulnerability Jose Conti CWE-862	CVE Database V5	2026-09-30
Medium	5.5	EPSS 0.2%	CVE-2026-97238JetEngine (WordPress plugin) · Cross-site Scripting Medium5.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97238 Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. EPSS 0.2%Vulnerability Crocoblock. Jetimpex CWE-79	CVE Database V5	2026-09-30
High	7.1	EPSS 0.2%	CVE-2026-97237JetEngine (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97237 CVE-2026-97237 is a high-severity DOM-based Cross-site Scripting (XSS) vulnerability in Crocoblock JetEngine. It affects versions from initial releases up to 3.8.14.3. The flaw arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch information is provided in the source data. EPSS 0.2%Vulnerability Crocoblock CWE-79	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.2%	CVE-2026-97236ThemeREX Addons (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97236 Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-09-30
High	7.1	EPSS 0.2%	CVE-2026-97235ThemeREX Addons (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-09-30CVE Database V5CVE-2026-97235 Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. EPSS 0.2%Vulnerability CWE-79	CVE Database V5	2026-09-30
High	7.5	EPSS 0.3%	CVE-2026-97197WebToffee WordPress Backup & Migration · Missing Authorization High7.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-97197 Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions. EPSS 0.3%Vulnerability CWE-862	CVE Database V5	2026-09-30

Page 23 of 72