Threat database

811 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
High	7.1	EPSS 0.2%	CVE-2026-104670LearnPress · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-104670 Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. EPSS 0.2%Vulnerability ThimPress #cwe-79	CVE Database V5	2026-10-06
High	8.1	EPSS 0.3%	CVE-2026-104405GiveWP · Incorrect Privilege Assignment High8.1EPSS 0.3%2026-10-06CVE Database V5CVE-2026-104405 Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. EPSS 0.3%Vulnerability Nexcess #cwe-266	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-104394Charitable · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-104394 Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. EPSS 0.2%Vulnerability Syed Balkhi #cwe-79	CVE Database V5	2026-10-06
High	7.2	EPSS 0.3%	CVE-2026-104387PowerPress Podcasting · Missing Authorization High7.2EPSS 0.3%2026-10-06CVE Database V5CVE-2026-104387 Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions. EPSS 0.3%Vulnerability blubrry #cwe-862	CVE Database V5	2026-10-06
High	7.5	EPSS 0.3%	CVE-2026-104385Groundhogg · Insertion of Sensitive Information Into Sent Data High7.5EPSS 0.3%2026-10-06CVE Database V5CVE-2026-104385 Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. EPSS 0.3%Vulnerability Adrian Tobey #cwe-201	CVE Database V5	2026-10-06
High	8.5	EPSS 0.2%	CVE-2026-102915WPO365 · Missing Authorization High8.5EPSS 0.2%2026-10-06CVE Database V5CVE-2026-102915 Subscriber Broken Access Control in WPO365 <= 44.1 versions. EPSS 0.2%Vulnerability Marco van Wieren #cwe-862	CVE Database V5	2026-10-06
High	7.5	EPSS 0.3%	CVE-2026-102387Xserver Migrator · Exposure of Sensitive System Information to an Unauthorized Control Sphere High7.5EPSS 0.3%2026-10-06CVE Database V5CVE-2026-102387 Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions. EPSS 0.3%Vulnerability XServer #cwe-497	CVE Database V5	2026-10-06
Medium	5.3	EPSS 0.3%	CVE-2026-100518Advanced Google reCAPTCHA · Authentication Bypass Using an Alternate Path or Channel Medium5.3EPSS 0.3%2026-10-06CVE Database V5CVE-2026-100518 Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions. EPSS 0.3%Vulnerability WebFactory #cwe-288	CVE Database V5	2026-10-06
Medium	4.8	EPSS 0.2%	CVE-2026-97308Login Lockdown · Authentication Bypass by Spoofing Medium4.8EPSS 0.2%2026-10-06CVE Database V5CVE-2026-97308 Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions. EPSS 0.2%Vulnerability WebFactory #cwe-290	CVE Database V5	2026-10-06
High	8.1	EPSS 0.2%	CVE-2026-95594SMS Alert Order Notifications · Incorrect Privilege Assignment High8.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-95594 CVE-2026-95594 is an Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd.'s SMS Alert Order Notifications plugin. It allows privilege escalation affecting versions from 0 up to but not including 4.0.1. The vulnerability has a high severity with a CVSS score of 8.1. EPSS 0.2%Vulnerability Cozy Vision Technologies Pvt. Ltd.#cwe-266	CVE Database V5	2026-10-06
High	7.3	EPSS 0.2%	CVE-2026-95526BEAR · Missing Authorization High7.3EPSS 0.2%2026-10-06CVE Database V5CVE-2026-95526 Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions. EPSS 0.2%Vulnerability RealMag777 #cwe-862	CVE Database V5	2026-10-06
High	7.1	EPSS 0.2%	CVE-2026-94675Fluent Forms Pro Add On Pack · Cross-site Scripting High7.1EPSS 0.2%2026-10-06CVE Database V5CVE-2026-94675 Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions. EPSS 0.2%Vulnerability Fluent Forms Free vs Pro #cwe-79	CVE Database V5	2026-10-06
High	7.5	EPSS 0.4%	CVE-2026-48199Sermon'e · Missing Authorization High7.5EPSS 0.4%2026-10-06CVE Database V5CVE-2026-48199 Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions. EPSS 0.4%Vulnerability Beplusthemes #cwe-862	CVE Database V5	2026-10-06
High	7.2	EPSS 0.5%	CVE-2026-48197PublishPress Capabilities · Incorrect Privilege Assignment High7.2EPSS 0.5%2026-10-06CVE Database V5CVE-2026-48197 Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0. EPSS 0.5%Vulnerability PublishPress	CVE Database V5	2026-10-06
High	7.5	EPSS 0.3%	CVE-2026-42638Easy Digital Downloads · Missing Authorization High7.5EPSS 0.3%2026-10-06CVE Database V5CVE-2026-42638 CVE-2026-42638 is a missing authorization vulnerability in Awesomemotive Easy Digital Downloads affecting versions before 3.7.1.1. It allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a high severity score of 7.5 and does not require user interaction or privileges to exploit. No official patch or vendor advisory is currently provided. EPSS 0.3%Vulnerability Awesomemotive #cwe-862	CVE Database V5	2026-10-06
Medium	6.5	EPSS 0.3%	CVE-2026-42637PayPlug for WooCommerce (Official) · Missing Authorization Medium6.5EPSS 0.3%2026-10-06CVE Database V5CVE-2026-42637 Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions. EPSS 0.3%Vulnerability Payplug #cwe-862	CVE Database V5	2026-10-06
High	7.1	EPSS 0.3%	CVE-2026-42636WP Cookie Notice for GDPR, CCPA & ePrivacy Consent · Cross-site Scripting High7.1EPSS 0.3%2026-10-06CVE Database V5CVE-2026-42636 Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions. EPSS 0.3%Vulnerability WP Legal Pages #cwe-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.3%	CVE-2026-42635WooCommerce Simple Auctions · Cross-site Scripting High7.1EPSS 0.3%2026-10-06CVE Database V5CVE-2026-42635 Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions. EPSS 0.3%Vulnerability wpgenie #cwe-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.3%	CVE-2026-42634Video Background Block – Use video as background in the section. · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in bPlugins Video Background Block – Use video as background in the section. High7.1EPSS 0.3%2026-10-06CVE Database V5CVE-2026-42634 Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions. EPSS 0.3%Vulnerability bPlugins #cwe-79	CVE Database V5	2026-10-06
High	7.1	EPSS 0.3%	CVE-2026-42418Social Rocket · Cross-site Scripting High7.1EPSS 0.3%2026-10-06CVE Database V5CVE-2026-42418 Social Rocket versions prior to 1.3.6 contain a reflected cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of the victim's browser. The issue affects all versions from 0 up to 1.3.5 inclusive. The vulnerability has a high severity rating with a CVSS score of 7.1. EPSS 0.3%Vulnerability Socialrocket #cwe-79	CVE Database V5	2026-10-06

Showing 601–620 of 811 results