Threat database

CVE-2026-94641 is a high-severity reflected cross-site scripting (XSS) vulnerability in the UsersWP plugin by Stiofan. It affects versions from initial releases up to 1.2.73. The flaw allows improper neutralization of input during web page generation, potentially leading to execution of malicious scripts in users' browsers.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.

CVE-2026-96809 is a critical SQL Injection vulnerability in MultiNet Interactive AB EduAdmin Booking software. It allows an attacker to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. The vulnerability affects all versions from initial releases up to but not including version 6.0.0. The CVSS 3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. No known exploits in the wild or patch information are provided.

CVE-2026-94415 is a reflected Cross-site Scripting (XSS) vulnerability in Muffingroup Betheme that affects versions up to and including 28.5.8. This vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a high severity with a CVSS score of 7.1. No patch or remediation information is currently provided.

CVE-2026-94166 is a reflected cross-site scripting (XSS) vulnerability in UpSolution UpSolution Core affecting versions from 0 up to and including 8.44. This vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that can be executed in the context of a user's browser session.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.

CVE-2026-96671 is a Cross-Site Request Forgery (CSRF) vulnerability in the Featured Image from URL plugin for fifu.app. It affects versions from initial releases up to 6.0.7. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The CVSS score is 8.8, indicating a high severity with potential for complete confidentiality, integrity, and availability impact. No patch or vendor advisory details are provided in the input data.

CVE-2026-96331 is a critical SQL Injection vulnerability in wpdreams Ajax Search Pro affecting versions from initial release up to 4.29.1. The flaw allows blind SQL injection attacks due to improper neutralization of special elements in SQL commands. This could lead to unauthorized data exposure and partial denial of service. No official patch or remediation details are provided in the input data.

CVE-2026-96330 is a critical SQL Injection vulnerability in tagDiv Opt-In Builder (td-subscription component) that allows blind SQL injection attacks. It affects versions from the initial release up to 1.7.6. The vulnerability can be exploited remotely without authentication and requires no user interaction. It impacts confidentiality and availability but does not affect integrity. No official patch information is provided in the source data.

CVE-2026-96329 is a high-severity SQL Injection vulnerability in the tagDiv Opt-In Builder plugin, specifically in the td-subscription component. It allows an attacker with low privileges to perform Blind SQL Injection attacks remotely without user interaction. The vulnerability affects versions from the initial release up to 1.7.6 inclusive.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.

CVE-2026-95609 is a stored cross-site scripting (XSS) vulnerability in the David Lingren Media LIbrary Assistant plugin. It affects versions from the initial release up to 3.41 inclusive. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in users' browsers. The CVSS 3.1 score is 7.1, indicating a high severity with potential impacts on confidentiality, integrity, and availability. There is no information about an available patch or official fix at this time.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.

CVE-2026-95597 is a Missing Authorization vulnerability in the 워드프레스 결제 심플페이 plugin for WooCommerce. It affects versions from 0 up to 5.5.17 and allows exploitation due to incorrectly configured access control security levels. The vulnerability can lead to integrity and availability impacts without requiring user interaction or privileges.

CVE-2026-95596 is a reflected cross-site scripting (XSS) vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons. It affects versions from 0 up to but not including 3.4.2. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in the context of the affected web application. The CVSS 3.1 score is 7.1, indicating a high severity level.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14.

CVE-2026-94568 is a high severity vulnerability in the Pay with Vipps for WooCommerce plugin by WP Hosting AS. It involves deserialization of untrusted data leading to object injection. This affects versions from initial releases up to 6.2.0. The vulnerability can result in complete compromise of confidentiality, integrity, and availability.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.

CVE-2026-96327 is a critical SQL Injection vulnerability in the VibeThemes WPLMS plugin. It allows an attacker to perform Blind SQL Injection due to improper neutralization of special elements in SQL commands. The issue affects all versions from initial releases up to but not including version 1.9.9.8.2. The vulnerability has a high CVSS score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and availability.

CVE-2026-95608 is a high-severity reflected cross-site scripting (XSS) vulnerability in the PluginUs.Net HUSKY woocommerce-products-filter plugin. It affects versions from initial releases up to 1.4.3.2. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating significant impact on confidentiality, integrity, and availability with network attack vector and low attack complexity. No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.