Threat database

CVE-2026-107594 is a critical vulnerability in the File Upload to Order WordPress plugin versions before 1.1.4. It allows unauthenticated attackers to delete arbitrary files on the server by exploiting improper validation of file paths derived from attacker-controlled session data. This flaw can lead to full site compromise due to the potential removal of critical files.

A path traversal vulnerability exists in the Ultimate Multisite WordPress plugin before version 2.17.2. This flaw allows unauthenticated attackers to include and read arbitrary local files on the server, including sensitive files such as the WordPress configuration file. The vulnerability arises from improper validation of user-supplied input used to select files for inclusion.

GamiPress WordPress plugin versions from 7.9.5 up to but not including 8.0.6 have an information exposure vulnerability. This flaw allows unauthenticated users to access private activity log entries of all users due to improper authorization. It is a partial fix of a previous vulnerability (CVE-2026-13450).

GamiPress WordPress plugin versions before 8.0.6 contain an authorization bypass vulnerability. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to access arbitrary entries in the activity log without proper capability or ownership checks. The exposed information includes other users' points balances, earned achievements, and usernames of administrators who manually awarded or revoked points.

CVE-2026-107178 is a cross-site scripting (XSS) vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin versions before 3.6.16. It allows users with contributor-level access or higher to inject JavaScript into the gallery lightbox configuration, which executes in the browsers of anyone viewing the gallery, including administrators.

CVE-2026-107160 is a vulnerability in the LTL Freight Quotes WordPress plugin versions before 4.2.19. The plugin fails to perform authorization checks or input sanitization when storing certain request values, allowing unauthenticated users to inject HTML and links that are rendered to storefront visitors. This can lead to integrity issues on the website content.

CVE-2026-107158 is a medium severity vulnerability in the LTL Freight Quotes WordPress plugin before version 4.2.19. It lacks authorization checks on a REST route that writes to the database, allowing unauthenticated users to modify some stored settings of the plugin.

A stored Cross-Site Scripting (XSS) vulnerability exists in the WP Booking System WordPress plugin before version 2.1.0.1. The plugin fails to properly sanitize and escape user-controllable input before storing and displaying it in an administration screen. This allows unauthenticated attackers to inject malicious scripts that execute in the context of an administrator's session when viewing the stored data.

The Classified Listing WordPress plugin versions before 6.1.1 contain a missing authorization vulnerability. This flaw allows any authenticated user with a subscriber-level account to modify, corrupt, or delete media-library attachments owned by other users, including administrators, by exploiting gallery requests referencing unattached media items. The vulnerability arises because the plugin does not verify ownership or edit permissions for the target listing in such requests.

CVE-2026-106469 is a cross-site scripting (XSS) vulnerability in the Gutenverse Form WordPress plugin before version 3.0.11. It arises because the plugin does not sanitize SVG icon markup stored in its form blocks before decoding and inserting it into the page. Authenticated users with Contributor-level access or higher can exploit this to store malicious SVG that executes JavaScript in the browser session of any user who views or previews the affected form, including administrators reviewing pending posts.

NEX-Forms WordPress plugin versions from 9.2.1 up to but not including 9.3.1 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to update stored form entries without any authorization or ownership checks by referencing their sequential identifiers. The vulnerability can lead to unauthorized modification, deletion, or reassignment of form entries.

CVE-2026-106099 is a medium severity information exposure vulnerability in the WP Data Access WordPress plugin versions before 5.5.84. The plugin does not properly restrict its database table export action to authorized users, relying only on a token that is publicly exposed on pages displaying tables. This allows unauthenticated attackers to export the full contents of any publicly displayed table, including data not shown to regular visitors.

CVE-2026-106098 is a medium severity vulnerability in the WP Data Access WordPress plugin before version 5.5.77. The plugin fails to properly check authorization on a REST endpoint, allowing unauthenticated attackers to perform write operations by only verifying read permissions. This can lead to unauthorized data modification even if update actions are disabled by the administrator.

CVE-2026-105975 is a missing authorization vulnerability in the CamPay Shortcode Payment Gateway WordPress plugin versions before 1.7. The plugin fails to verify the authenticity of Mobile Money payment confirmations and relies on client-supplied parameters to determine payment status. This flaw allows unauthenticated attackers to mark payment records as paid, delete genuine payment records, and write plugin metadata onto arbitrary posts.

CVE-2026-105969 is a medium severity information exposure vulnerability in the CodeAtoZ B2B Suite for WooCommerce WordPress plugin versions before 1.6.1. It allows unauthenticated users to access guest-submitted quotes by enumerating identifiers, exposing sensitive information such as buyer names, email addresses, and requested line items.

CVE-2026-105261 is a cross-site scripting (XSS) vulnerability in the WordPress plugin Schedule Post Changes With PublishPress Future (versions >=4.10.1 and <4.10.6). It allows users with Contributor role or higher to inject JavaScript via a shortcode attribute that is not properly sanitized. This malicious script executes in the session of any higher-privileged user who views the affected content, potentially compromising confidentiality, integrity, and availability.

CVE-2026-104751 is a vulnerability in the Rank Math SEO WordPress plugin versions before 1.0.280. The plugin fails to perform capability or nonce checks before allowing the clearing of stored SEO analysis data. This flaw allows unauthenticated users to delete SEO analysis data without authorization.

CVE-2026-104644 is a cross-site scripting (XSS) vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin before version 3.6.15. It allows users with contributor-level access or higher to inject JavaScript code via unsanitized gallery configuration values. This malicious script executes in the browsers of anyone viewing the gallery, including administrators.

CVE-2026-103307 is a high-severity SQL injection vulnerability in the Walletdoc Payment Gateway for WooCommerce WordPress plugin versions before 1.8.5. The plugin fails to properly sanitize and escape user input in SQL statements and uses a payment webhook signing secret that is empty by default. This allows unauthenticated attackers to perform SQL injection attacks and mark arbitrary orders as paid.

CVE-2026-94370 is a medium severity vulnerability in Qt for MCUs versions 2.12.1 and 2.12.2. It involves a double free condition caused by improper handling of string memory ownership when converting std::string text passed into Qt Quick Ultralite. This can lead to heap memory corruption including double free, invalid free, or use-after-free errors.