Threat database

CVE-2026-42709 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in the RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin, affecting versions up to 6.0.5. This vulnerability allows attackers to inject malicious scripts during web page generation without authentication. The flaw is categorized under CWE-79, indicating improper neutralization of input. No specific affected versions or patch information is provided in the available data.

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

The Classified Listing - Mobile Number Verification plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 1.6.0. This flaw arises from missing server-side Firebase OTP validation in the process_otp_login() function, allowing unauthenticated attackers to log in as any user by submitting arbitrary OTP codes and user IDs. Exploitation requires OTP login enabled with Firebase as the verification gateway and knowledge or guessing of the target's registered phone number. Administrator accounts with registered phone numbers are also vulnerable to takeover.

CVE-2026-32477 is a high-severity vulnerability in ShopBuilder Pro – Elementor WooCommerce Builder Addons versions up to 2.2.0. It allows unauthenticated attackers to perform arbitrary file deletion via a path traversal flaw (CWE-22). This vulnerability can cause denial of service or data loss by deleting critical files. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-66647 is a medium severity vulnerability in RadiusTheme's Homlisti product affecting versions up to 3.1.2. It involves missing authorization controls, classified as CWE-862, which can lead to broken access control for subscribers. The vulnerability does not impact confidentiality or availability but can cause integrity issues. No patch or remediation details are provided in the available data.

Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme Review Schema review-schema allows Retrieve Embedded Sensitive Data.This issue affects Review Schema: from n/a through <= 2.2.6.

Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.11.

Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team: from n/a through <= 5.0.13.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Retrieve Embedded Sensitive Data.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 3.2.4.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Medilink-Core medilink-core allows PHP Local File Inclusion.This issue affects Medilink-Core: from n/a through < 2.0.7.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Metro metro allows PHP Local File Inclusion.This issue affects Metro: from n/a through <= 2.13.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RadiusTheme Metro metro allows DOM-Based XSS.This issue affects Metro: from n/a through <= 2.13.