EUVD-2026-60788

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73366 WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73366 WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73366

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73366

The WordPress Easy Google Maps plugin (≤1.13.0) has an unauthenticated PHP Object Injection vulnerability, exploitable remotely without credentials, scoring CVSS 9.8 (Critical). No in-the-wild exploitation or patch details are provided in the documents.

CVE-2026-73365 WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...

CVE-2026-73365

Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...

EUVD-2026-60787

Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...

CVE-2026-73365 WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...

CVE-2026-73365

The JetAppointment WordPress plugin (versions 2.5.2 and earlier) contains an unauthenticated SQL injection, exploitable over the network with no credentials, allowing attackers to read sensitive database data; CVSS 9.3 critical. Patchstack's advisory link is provided for details. Exploitation det...

CVE-2026-73362 WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in URL Shortify = 2.5.0 versions...

CVE-2026-73362

Unauthenticated Cross Site Scripting XSS in URL Shortify = 2.5.0 versions...

CVE-2026-73362

Affected product: WordPress URL Shortify plugin (versions ≤ 2.5.0). Vulnerability: Unauthenticated Cross-Site Scripting (XSS) — no privileges required. CVSS 3.1 base score 7.1 (HIGH), vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Exploitation status: not provided. Remediation: upgrade to a patched ...

CVE-2026-73361

Unauthenticated reflected/stored XSS affects Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18; CVSS 7.1 HIGH (network, no auth, user interaction required). No exploitation details provided; update to a newer plugin version when available.

CVE-2026-73361 WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...

EUVD-2026-60785

Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...

CVE-2026-73360 WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...

CVE-2026-73360

The WordPress Chaty Pro plugin (versions ≤ 3.5.8) has an unauthenticated reflected/stored XSS flaw exploitable over the network with low complexity; Patchstack rates it HIGH (CVSS 7.1). Upgrade beyond 3.5.8 to mitigate. No in-the-wild exploitation reported. https://patchstack.com/database/wordpre...

CVE-2026-73360 WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...

CVE-2026-73359 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...