PatchTheCVEunknown vulnerabilities
Recent CVEs affecting unknown products. 15 tracked.
unknown has 15 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 15. Most recent: 2026-10-25. Highest priority: CVE-2026-115251 (score 2/100).
- CVE-2026-115251 HIGH n/a UPGRADE The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed
- CVE-2026-115214 HIGH n/a UPGRADE The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role
- CVE-2026-115183 HIGH n/a UPGRADE The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text
- CVE-2026-114743 HIGH n/a UPGRADE The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connec
- CVE-2026-114742 HIGH n/a UPGRADE The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual t
- CVE-2026-114741 HIGH n/a UPGRADE The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and up
- CVE-2026-114740 HIGH n/a UPGRADE The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour throug
- CVE-2026-111981 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address c
- CVE-2026-111980 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request
- CVE-2026-111979 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form te
- CVE-2026-111978 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before readin
- CVE-2026-111976 HIGH n/a UPGRADE The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a
- CVE-2026-110285 HIGH n/a UPGRADE The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no s
- CVE-2025-15705 HIGH n/a UPGRADE The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowin
- CVE-2026-94295 HIGH n/a UPGRADE The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment n
FAQ
How do I fix unknown vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is unknown being exploited right now?
None of the tracked unknown CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which unknown CVE should I patch first?
CVE-2026-115251 currently ranks highest (2/100): The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed.