Priority LOW 27
The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insuff…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0028 · Published 2026-11-07 · No fix listed CWE-79
Priority LOW 37
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00338 · Published 2026-10-10 · Fixed in 1.4 CWE-98
Priority LOW 37
Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
CVSS 3.1HIGH 8.5· Network · Low privileges · No interaction · EPSS 0.00332 · Published 2026-10-10 · No fix listed CWE-89
Priority LOW 30
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00175 · Published 2026-10-10 · No fix listed CWE-79
Priority LOW 30
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.00175 · Published 2026-10-10 · No fix listed CWE-79
Priority LOW 28
Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.00174 · Published 2026-09-30 · No fix listed CWE-79
Priority LOW 27
The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00368 · Published 2026-09-18 · No fix listed CWE-79
Priority LOW 28
The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient…
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00261 · Published 2026-09-15 · No fix listed CWE-79
Priority LOW 38
Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-08-13 · No fix listed CWE-98
Priority LOW 38
Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-08-13 · No fix listed CWE-98
Priority MEDIUM 46
Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
CVSS 3.1CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.004 · Published 2026-08-06 · No fix listed CWE-89
Priority LOW 35
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2…
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00511 · Published 2026-07-13 · No fix listed CWE-98
Priority LOW 20
The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter due to missing validation on a user controlled key.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00336 · Published 2026-07-01 · No fix listed CWE-639
Priority LOW 38
Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00494 · Published 2026-06-17 · No fix listed CWE-35
Priority LOW 37
Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0025 · Published 2026-06-17 · No fix listed CWE-502
Priority LOW 37
Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0025 · Published 2026-06-17 · No fix listed CWE-502
Priority LOW 37
Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00308 · Published 2026-06-17 · No fix listed CWE-502
Priority LOW 37
Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00308 · Published 2026-06-17 · No fix listed CWE-502
Priority LOW 38
Unauthenticated Local File Inclusion in ChapterOne <= 1.7 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00423 · Published 2026-06-17 · No fix listed CWE-98
Priority LOW 38
Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00423 · Published 2026-06-17 · No fix listed CWE-98
Priority LOW 37
Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0032 · Published 2026-06-16 · No fix listed CWE-502
Priority LOW 37
Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0025 · Published 2026-06-16 · No fix listed CWE-502
Priority LOW 37
Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0032 · Published 2026-06-16 · No fix listed CWE-502
Priority LOW 37
Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0032 · Published 2026-06-16 · No fix listed CWE-502
Priority LOW 35
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Mikado Core mikado-core allows PHP Local File Inclusion.This issue affects Mikado Cor…
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00396 · Published 2026-04-08 · No fix listed CWE-98
Load more
THREATIST.IORead the docs