WordPress Unlimited Elements For Elementor plugin <= 2.0.16 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.16...

CVE-2026-17037

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress HUSKY plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Kuba in WordPress Plugin HUSKY versions = 1.4.3...

WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by benzdeus in WordPress Plugin Gato GraphQL versions = 19.2.3...

CVE-2026-17037 Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

WordPress Masteriyo - LMS plugin = 3.4.0 - PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 3.4.0...

WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions 2.45.0...

CVE-2026-6641

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

CVE-2026-6640

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress CM HIPAA Forms plugin < 3.2.0 - Unauthenticated Authorization Bypass vulnerability

Unauthenticated Authorization Bypass vulnerability discovered by David Ballard in WordPress Plugin HIPAA FORMS versions 3.2.0...

WordPress SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin < 4.7.40 - Subscriber+ TLS Private Key Disclosure vulnerability

Subscriber+ TLS Private Key Disclosure vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin SSL Zen versions 4.7.40...

WordPress Site Reviews plugin 7.2.2-8.2.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Jakub Herman in WordPress Plugin Site Reviews versions 7.2.2-8.2.2...

WordPress All in One SEO plugin < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block vulnerability

Contributor+ Stored XSS via ai-assistant Block vulnerability discovered by Asaf Mozes in WordPress Plugin All In One SEO Pack versions 5.0.0.1...

WordPress WP Express Checkout plugin < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment vulnerability

Unauthenticated Payment Bypass via wpecprocesspayment vulnerability discovered by Amity Gilmour in WordPress Plugin WP Express Checkout Accept PayPal Payments versions 2.4.9...

WordPress Ultimate Gift Cards For WooCommerce plugin < 3.2.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Ultimate Gift Cards For WooCommerce versions 3.2.10...

CVE-2026-6642 Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts...

CVE-2026-6642

The Media Library Assistant WordPress plugin (versions up to and including 3.35 ) is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism. The root cause is insufficient output escaping in the mla_generate_bulk_edit_form_fieldsets() function and the mla-bulk-...

CVE-2026-6640 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-6640

The Media Library Assistant WordPress plugin is vulnerable to Stored Cross-Site Scripting via the mla_link_attributes parameter in all versions up to and including 3.35 , caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher...

EUVD-2026-76007

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...