EUVD-2026-71870

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Administrator Email Disclosure vulnerability

Contributor+ Administrator Email Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

CVE-2026-84899 VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

CVE-2026-84899

The VikWidgetsLoader WordPress plugin versions before 1.12.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to sanitize or escape a block attribute before outputting it within an inline script. This allows users with the Contributor role to store arb...

EUVD-2026-71867

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

CVE-2026-84926

The EmbedPress WordPress plugin (versions 4.6.0 - 4.6.3 ) is vulnerable to an information disclosure flaw due to improper access control on one of its Google Reviews REST routes . This allows any authenticated user with contributor-level access or higher to view the site administrator's email add...

CVE-2026-84930

The CatFolders Document Gallery & PDF Library WordPress plugin versions before 2.0.7 is vulnerable to a Stored XSS flaw. The application fails to properly validate a block attribute before utilizing it as an HTML tag name within its gallery output. This allows users with the Author role or higher...

CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

CVE-2026-84931

The Joli Table Of Contents WordPress plugin, in versions prior to 3.0.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize or escape a shortcode attribute value before it is outputted inside an HTML element's attribute. This allows users with the Auth...

WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability

Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.22...

CVE-2026-84930 CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Google Reviews Modification vulnerability

Contributor+ Google Reviews Modification vulnerability discovered by Artus KG in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

CVE-2026-84927

The EmbedPress WordPress plugin (versions 4.6.0-4.6.3 ) is vulnerable to a missing authorization check on one of its Google Reviews REST API routes. This flaw allows users with Contributor role privileges or higher to modify a site-wide store, which includes the ability to delete entries configur...

CVE-2026-84899 VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

WordPress VikWidgetsLoader plugin < 1.12.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin VikWidgetsLoader versions 1.12.0...

CVE-2026-84221

The Kirki WordPress plugin (versions 6.0.0 - 6.2.5 ) is vulnerable to SQL injection because it fails to escape a user-supplied identifier before incorporating it into a SQL query. This flaw specifically affects the Content Manager Field ID . An attacker with editor-level access or higher can expl...

CVE-2026-84898

The Eventin (also referred to as WP Event Solution ) WordPress plugin, versions prior to 4.1.21 , contains a local file inclusion (LFI) vulnerability. The root cause is a failure to properly validate a template path value before using it to include a local file. This flaw allows authenticated use...

CVE-2026-84745 The Events Calendar &lt; 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...

CVE-2026-84225

The Kirki WordPress plugin versions 6.0.0 through 6.2.5 is vulnerable to an Authorization Bypass via IDOR . The plugin fails to verify if a user is authorized to modify a collaboration comment before changing its state. This allows users granted content-level access to the page builder to modify ...