Threat database

1,404 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.9	EPSS 0.3%	CVE-2026-94681Tijmen Smit WP Store Locator · Unthrottled Resource Allocation Medium5.9EPSS 0.3%2026-09-30CVE Database V5CVE-2026-94681 Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions. EPSS 0.3%Vulnerability CWE-770	CVE Database V5	2026-09-30
High	8.8	EPSS 0.4%	CVE-2026-94678Go Live Update Urls (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94678 Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions. EPSS 0.4%Vulnerability Mat Lipe CWE-502	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-94677Kadence WooCommerce Email Designer (WordPress plugin) · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94677 Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions. EPSS 0.4%Vulnerability Nexcess CWE-502	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.2%	CVE-2026-94674Pixel Manager for WooCommerce (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-94674 Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions. EPSS 0.2%Vulnerability SweetCode CWE-79	CVE Database V5	2026-09-30
Medium	5.3	EPSS 0.2%	CVE-2026-94673Simply Schedule Appointments (WordPress plugin) · Insecure Direct Object Reference Medium5.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-94673 Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions. EPSS 0.2%Vulnerability NSquared CWE-639	CVE Database V5	2026-09-30
Medium	4.3	EPSS 0.2%	CVE-2026-94672Safe SVG (WordPress plugin) · Insecure Direct Object Reference Medium4.3EPSS 0.2%2026-09-30CVE Database V5CVE-2026-94672 Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions. EPSS 0.2%Vulnerability 10up CWE-639	CVE Database V5	2026-09-30
High	7.1	EPSS 0.3%	CVE-2026-94499FormGent (WordPress plugin) · Missing Authorization High7.1EPSS 0.3%2026-09-30CVE Database V5CVE-2026-94499 Subscriber Broken Access Control in FormGent <= 1.12.2 versions. EPSS 0.3%Vulnerability wpWax CWE-862	CVE Database V5	2026-09-30
Critical	9.0	EPSS 0.4%	CVE-2026-94389AcyMailing SMTP Newsletter (WordPress plugin) · Code Injection Critical9.0EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94389 Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions. EPSS 0.4%Vulnerability AcyMailing Newsletter Team CWE-94	CVE Database V5	2026-09-30
High	7.5	EPSS 0.3%	CVE-2026-94178Import and export users and customers (WordPress plugin) · Incorrect Privilege Assignment High7.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-94178 Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions. EPSS 0.3%Vulnerability Javier Carazo CWE-266	CVE Database V5	2026-09-30
High	8.5	EPSS 0.3%	CVE-2026-94177GamiPress (WordPress plugin) · SQL Injection High8.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-94177 CVE-2026-94177 is a high-severity SQL Injection vulnerability in the GamiPress plugin by Ruben Garcia. It allows an attacker with limited privileges to perform blind SQL injection attacks, potentially leading to high confidentiality impact and limited availability impact. The vulnerability affects all versions from initial releases up to 8.0.2 inclusive. No official patch or remediation information is provided in the available data. EPSS 0.3%Vulnerability Ruben Garcia CWE-89	CVE Database V5	2026-09-30
Medium	5.4	EPSS 0.2%	CVE-2026-94173Business Directory (WordPress plugin) · Insecure Direct Object Reference Medium5.4EPSS 0.2%2026-09-30CVE Database V5CVE-2026-94173 Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions. EPSS 0.2%Vulnerability Strategy11 Team CWE-639	CVE Database V5	2026-09-30
High	7.5	EPSS 0.4%	CVE-2026-94123NextGEN Gallery (WordPress plugin) · Path Traversal High7.5EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94123 Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions. EPSS 0.4%Vulnerability Syed Balkhi CWE-22	CVE Database V5	2026-09-30
High	7.2	EPSS 0.4%	CVE-2026-94122Responsive Slider Gallery (WordPress plugin) · Deserialization of Untrusted Data High7.2EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94122 Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions. EPSS 0.4%Vulnerability A WP Life CWE-502	CVE Database V5	2026-09-30
High	8.8	EPSS 0.4%	CVE-2026-9412110Web Booster (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.4%2026-09-30CVE Database V5CVE-2026-94121 Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions. EPSS 0.4%Vulnerability CWE-502	CVE Database V5	2026-09-30
High	7.5	EPSS 0.3%	CVE-2026-94120GravityExport Lite for Gravity Forms (WordPress plugin) · Missing Authorization High7.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-94120 Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions. EPSS 0.3%Vulnerability GravityKit CWE-862	CVE Database V5	2026-09-30
High	8.5	EPSS 0.3%	CVE-2026-94115Easy Pricing Tables (WordPress plugin) · SQL Injection High8.5EPSS 0.3%2026-09-30CVE Database V5CVE-2026-94115 Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions. EPSS 0.3%Vulnerability Fatcatapps CWE-89	CVE Database V5	2026-09-30
High	7.6	EPSS 0.3%	CVE-2026-94082Quiz Cat (WordPress plugin) · SQL Injection High7.6EPSS 0.3%2026-09-30CVE Database V5CVE-2026-94082 Author SQL Injection in Quiz Cat <= 3.1.1 versions. EPSS 0.3%Vulnerability Fatcatapps CWE-89	CVE Database V5	2026-09-30
High	7.1	EPSS 0.2%	CVE-2026-94081WordPress Persistent Login · Cross-site Scripting High7.1EPSS 0.2%2026-09-30CVE Database V5CVE-2026-94081 Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions. EPSS 0.2%Vulnerability lukeseager CWE-79	CVE Database V5	2026-09-30
High	7.1	EPSS 0.2%	CVE-2026-94078Site Reviews (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-09-30CVE Database V5CVE-2026-94078 Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions. EPSS 0.2%Vulnerability Gemini Labs CWE-79	CVE Database V5	2026-09-30
Medium	6.5	EPSS 0.2%	CVE-2026-94077Safe SVG (WordPress plugin) · Cross-site Scripting Medium6.5EPSS 0.2%2026-09-30CVE Database V5CVE-2026-94077 Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions. EPSS 0.2%Vulnerability 10up CWE-79	CVE Database V5	2026-09-30

Page 26 of 72