Threat database

A vulnerability in the WP Roster WordPress plugin before version 2.36 allows unauthenticated attackers to overwrite, wipe, or restore roster content due to missing capability and nonce checks.

A stored cross-site scripting (XSS) vulnerability exists in the Text Typing WordPress plugin versions before 2.2.2. This flaw allows users with Contributor role or higher to inject malicious scripts via a block attribute that is not properly sanitized or escaped. The injected script executes in the browsers of users viewing the affected page.

A vulnerability in the WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.137 allows an authenticated administrator to upload files with arbitrary extensions, including potentially dangerous PHP files, due to improper validation of the file extension during import uploads. This issue is a result of an incomplete fix from a previous vulnerability (CVE-2025-5961).

CVE-2026-115242 is a path traversal vulnerability in the WPvivid — Backup, Migration & Staging WordPress plugin versions before 0.9.137. An authenticated administrator can exploit this flaw by supplying a staging destination folder path containing traversal sequences, causing the plugin to write copied site files outside the intended WordPress installation directory.

A vulnerability in the WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.137 allows an authenticated administrator to cause the plugin to drop database tables by supplying arbitrary snapshot identifiers. This improper access control flaw can lead to destruction of the site's database, including core WordPress tables.

A cross-site scripting (XSS) vulnerability exists in the Enable Media Replace WordPress plugin versions before 4.2.3. The flaw occurs because replaced media files are not processed through the WordPress upload pipeline, bypassing the SVG sanitizer prefilter. This allows an authenticated user with upload permissions to upload an SVG file containing malicious script that executes when the file is opened directly. The vulnerability requires the SVG-enabling feature of the plugin to be active.

A vulnerability in the Duplicator WordPress plugin versions 5.0.0 up to but not including 5.1.0 allows unauthenticated users to access certain PHP files directly. This causes fatal errors that disclose server absolute filesystem paths via stack traces, potentially revealing sensitive information.

A reflected cross-site scripting (XSS) vulnerability exists in the Duplicator WordPress plugin versions before 5.1.0. The flaw arises because the plugin does not properly sanitize and escape a parameter before reflecting it on an administrative page. This vulnerability can be exploited if a logged-in administrator is tricked into opening a crafted link, allowing execution of arbitrary scripts in their session.

WP Remote Users Sync versions before 2.2.0 expose user export files containing personal data due to insufficient access restrictions. The plugin relies on Apache-specific access controls that are ineffective on other web servers like Nginx, allowing unauthenticated attackers to access sensitive user information by requesting predictable export file names.

A vulnerability in the Post Duplicator WordPress plugin before version 3.0.17 allows users with Contributor roles to access titles and hierarchy information of other users' draft and private posts without proper authorization checks.

A vulnerability in the Essential Real Estate WordPress plugin before version 5.3.5 allows self-registered customer-level users to delete media attachments owned by other users, including administrators. This occurs because the plugin does not verify ownership of media attachments before deletion.

A Server-Side Request Forgery (SSRF) vulnerability exists in the PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before version 3.1.3. This flaw allows users with contributor role or higher to supply a URL that is not validated before the plugin makes a server-side HTTP request. Exploitation could enable attackers to access internal or loopback network resources and read the responses.

A missing authorization vulnerability in the FV Flowplayer Video Player WordPress plugin before version 7.5.56.7212 allows users with Contributor-level permissions and above to disclose and bulk-modify stored video records across the entire site. The flaw arises because one video-migration function relies solely on a nonce for protection without proper authorization checks.

FV Flowplayer Video Player WordPress plugin versions before 7.5.56.7212 contain an authorization bypass vulnerability. Authenticated users with Contributor-level access or higher can modify or delete video and metadata records belonging to other users without proper ownership verification. This flaw also allows disclosure of associated metadata in responses.

A stored cross-site scripting (XSS) vulnerability exists in the SEOPress WordPress plugin versions before 10.4. The plugin fails to properly sanitize and escape certain analytics tracking settings before outputting them in an inline script on every front-end page. This flaw allows users with a specific SEOPress capability, which can be delegated by an administrator to lower-privileged roles, to inject malicious scripts that execute in the browsers of any site visitor, including logged-in administrators viewing the front end.

A cross-site scripting (XSS) vulnerability exists in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.29. Users with author-level access or higher can inject arbitrary JavaScript into form button configurations, which executes in the browser of any user clicking the button, including administrators.

A vulnerability in the Booking Package WordPress plugin before version 1.7.34 allows unauthenticated users to create confirmed bookings without completing payment on calendars that require online payment.

Form Maker by 10Web WordPress plugin versions before 1.15.51 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated users to submit malicious scripts that execute in the administrator's browser when viewing form submissions. The issue arises from inconsistent escaping of user-submitted field values on the submissions admin page. A fixed version 1.15.51 is available to address this vulnerability.

A vulnerability in the ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before version 1.17.11 allows any authenticated user, including those with minimal privileges such as Subscribers, to access sensitive HR, CRM, and Accounting data. This occurs because the plugin does not perform proper capability checks on an AJAX action that returns before-and-after values of record changes, enabling unauthorized data exposure.

A cross-site scripting (XSS) vulnerability exists in the CookieYes WordPress plugin versions before 3.5.8. This flaw allows users with the Contributor role to inject JavaScript into cookie-category script fields without proper sanitization or escaping. The injected script executes in the browsers of site visitors and administrators reviewing the content.