CVE-2026-66599 WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...

CVE-2026-66599

CVE-2026-66599 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPComplete , affecting versions 2.9.5.6 and earlier . The vulnerability was discovered by Asim Alshaya and carries a CVSS v3.1 score of 7.1 (HIGH) with a scope change (CHANGED), reflecting the ab...

CVE-2026-66584 WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

EUVD-2026-64830

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

CVE-2026-78291 WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in RepairBuddy = 4.1223 versions...

WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jamaal ahmed in WordPress Plugin UltimateAI versions = 3.1.0...

WordPress LitExtension: Store to WooCommerce Migration plugin <= 1.2.5 - Connector Token Takeover via CSRF vulnerability

Connector Token Takeover via CSRF vulnerability discovered by marim00 in WordPress Plugin LitExtension: WooCommerce Migration Plugin versions = 1.2.6...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Unauthenticated RCE via Control Character Filename Bypass vulnerability

Unauthenticated RCE via Control Character Filename Bypass vulnerability discovered by Jakub Herman in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...

CVE-2026-9833

CVE-2026-9833 CVE-ID: CVE-2026-9833 Art der Schwachstelle: Cross-Site Scripting XSS – Reflektiertes XSS CWE: CWE-79 – Unsachgemäße Neutralisierung von Eingaben während der Webseitengenerierung 'Cross-site Scripting' Schweregrad: Hoch CISA ADP CVSS v3.1: 7.1 Überblick CVE-2026-9833 betrifft das...

WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin RepairBuddy versions = 4.1223...

WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Magazine Blocks versions = 1.8.6...

WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by sanghyeok Kim in WordPress Plugin Hash Form versions = 1.4.0...

WordPress Fluent Support Pro plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress Fluent Boards Pro plugin <= 2.0.11 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Boards Pro versions = 2.0.11...

WordPress FluentCRM Pro plugin <= 3.1.12 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

WordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Fluent Support Pro versions = 2.3.1...

WordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin FluentCRM Pro versions = 3.1.12...

WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Cem Bas in WordPress Plugin Shared Files versions = 1.7.69...

WordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bao - BlueRock in WordPress Plugin Booking and Rental Manager versions = 2.7.5...

wp2shell-vulnerability-scanner

WP2Shell Scanner A read-only, non-destructive security audit tool that scans WordPress installations for the wp2shell vulnerability chain. Panoramica WP2Shell Scanner è un'utilità bash che ricerca ricorsivamente un albero di directory per installazioni WordPress e verifica se ciascun sito esegue...