WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by jydae in WordPress Plugin GiveWP versions = 4.17.0...

WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin picu versions = 3.10.1...

WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability

Bypass vulnerability vulnerability discovered by Peter Tang in WordPress Plugin Zero Spam versions = 5.7.11...

WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Import and export users and customers versions = 2.5.5...

WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SiteVault – Backup, Restore, Migration & Cloning versions = 1.5.17...

WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Asim Alshaya in WordPress Plugin Advanced Google reCAPTCHA versions = 5.40...

WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Peter Tang in WordPress Plugin Sirv versions = 8.2.5...

WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin Event Tickets versions = 5.30.0...

WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Premium Addons for Elementor versions = 4.11.109...

WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Video Conferencing with Zoom versions = 4.6.10...

WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Image Photo Gallery Final Tiles Grid versions = 3.6.13...

WordPress SaveTo Wishlist Lite plugin < 1.1.5 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Naoki Kawahigashi in WordPress Plugin SaveTo Wishlist Lite versions 1.1.5...

CVE-2026-84169

The UPI QR Code Payment Gateway WordPress plugin, affecting versions through 1.4.3 , contains a vulnerability where it fails to verify if a payment-confirmation request belongs to the specific order and customer it claims to confirm. This lack of authorization allows unauthenticated attackers to ...

CVE-2026-84169: Authorization Bypass Through User-Controlled Key

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by HaiND in WordPress Plugin Smart Forms versions = 2.6.104...

WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by ParkHyunWoo in WordPress Plugin PDF Smart Viewer for Elementor versions = 1.0.4...

WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Asim Alshaya in WordPress Plugin Progress Planner versions = 1.10.0...

WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Eunho Kim in WordPress Plugin PDF for Contact Form 7 versions = 7.1.0...

CVE-2026-17005

The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page Contributor and above, once permitte...