CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-18057

The vulnerability CVE-2026-18057 affects the Events Manager WordPress plugin prior to version 7.4.1. The root cause is failure to sanitize and escape a user-controlled value before its use in a SQL statement, which enables SQL injection. Impact is that users with a subscriber account and above ca...

CVE-2026-18035

The CVE-2026-18035 affects the WordPress plugin User Access Manager (pre-2.3.15). The REST API does not enforce the plugin’s access restrictions, allowing unauthenticated attackers to read content (posts, pages, and custom post types) restricted to specific user groups. Impact is limited to expos...

CVE-2026-18046

The CVE concerns the Cookie Consent WordPress plugin prior to 0.0.10. A REST route that stores the geolocation service license key does not correctly enforce its administrator-only capability check, falling back to an authentication-only gate. This allows any authenticated user (e.g., a subscribe...

CVE-2026-18048

The WP Photo Album Plus WordPress plugin, prior to version 9.2.07.002, fails to validate a client-controlled value used to build a file path in a public endpoint action and does not perform an authorization check. This allows unauthenticated attackers to delete arbitrary ZIP archives on the serve...

EUVD-2026-57097

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people...

CVE-2026-18046 Cookie Consent < 0.0.10 - Subscriber+ MaxMind License Key Update

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on the REST route that stores its geolocation service license key, so the route falls back to an authentication-only gate, allowing any authenticated user such as a...

CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013

The vulnerability affects the WP Photo Album Plus WordPress plugin prior to version 9.2.07.002. The issue is that a parameter is not properly sanitised/escaped before being reflected into an inline script block, enabling unauthenticated attackers to perform Reflected Cross-Site Scripting against ...

CVE-2026-16294 Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...

EUVD-2026-57091

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

EUVD-2026-57088

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...

CVE-2026-16294

The CVE-2026-16294 entry concerns the PowerPress Podcasting plugin by Blubrry for WordPress (versions before 11.17.1). The issue: a Podcast Episode URL setting is not validated before a server-side request, enabling Server-Side Request Forgery by users with a role as low as Contributor to target ...

CVE-2026-16977 Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

CVE-2026-16977

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

CVE-2026-16294

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target...

CVE-2026-16977

The Form Maker by 10Web WordPress plugin is affected (versions before 1.15.45). The vulnerability arises when a user-controlled value is not properly parameterized in a dynamic SQL query used for a database-backed field, enabling second-order SQL injection by subscriber-level users. Affected comp...

CVE-2026-15249

Summary (CVE-2026-15249) : The Patterns Kit WordPress plugin (≤ 1.0.3) is affected by a stored XSS vulnerability: it does not escape a link attribute before a client-side script inserts it into the page, enabling a user with Contributor privileges to store a payload that executes in the browser o...

CVE-2026-15249 Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

EUVD-2026-57087

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...