Results
90,429· Page 361/1809Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allo
Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.
Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.
Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.
Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngi
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.
Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0
Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & C
Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.
Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.
Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.
Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.
Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.
Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.
Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.
Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.
Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.
Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.
Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.
Test your stack for 2026issues
CyberStrike tests your own apps and APIs, then verifies each finding before you see it.