CVE-2026-120035

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'itemtitle parsed from feed ' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization an...

CVE-2026-107658

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bfposttype and buddyformsformcontent' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2026-116624

The Advanced Members for ACF plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.3.0 via the acfamemlocaluserpassword parameter of the advanced-members-account-password shortcode form submission. This is due to a PHP operator-precedence bug in the...

CVE-2026-92895

The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the downloadonefile function. This is due to missing file extension whitelist and MIME type validation in downloadonefile when writing files derived from...

CVE-2026-119178

The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-119211

The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'optionpage' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-116545

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'customfields.value.label for key='track'' parameter in all versions up to, and including, 5.0.0 due to insufficient...

CVE-2026-104010

The WPSyncSheets For Contact Form 7 – CF7 Google Sheets Connector & Save to Database plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.8.0 via the 'any non-system CF7 field e.g., your-message' parameter parameter. This is due to insufficient...

CVE-2026-116551

The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-107622

The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bfposttype parameter. This is due to the public frontend submission handler buddyformsformresponsenoajax authorizing logged-out...

CVE-2026-114630

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factoryreset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete...

CVE-2026-103479

The Pubjet | پاب‌جت plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.4.8. This is due to the checkToken AJAX handler — registered under wpajaxpubjet-check-token — performing no capability check and no nonce verification before unconditionally...

CVE-2026-115831

The VOD Infomaniak plugin for WordPress (versions up to and including 1.5.15 ) is vulnerable to an authorization bypass. The vodimportvideo AJAX action fails to properly verify user permissions, allowing authenticated users with subscriber-level access to perform actions intended only for Contrib...

CVE-2026-97642

The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 6.4 . The vulnerability exists in the calendar Gutenberg block due to insufficient input sanitization and output escaping of the 'theme' attribute . Specifically, the printCale...

CVE-2026-120659

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 3.2.14 . The root cause is the plugin's failure to properly verify user permissions for specific actions. This flaw allows unauthenticated attackers to write arbitrary ...

CVE-2026-109977

The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection in versions up to and including 2.7.8 . The root cause is insufficient escaping of the user-supplied params[searchKey] parameter combined with a lack of sufficient prepara...

CVE-2026-109994

The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 4.1.29 . The root cause is a Missing Authorization flaw involving the 'id' parameter . An authenticated attacker wit...

CVE-2026-110776

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.1 . The root cause is insufficient input sanitization and output escaping of the 'vars' parameter . An unauthenticated attacker can inject arbitra...

CVE-2026-120550

The WP User Manager plugin for WordPress (versions up to and including 2.10.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the name parameter of the REST users endpoint (wp_users.display_name). This allows authenti...

CMSmap

CMSmap CMSmap is a python open source CMS scanner that automates the process of detecting security flaws of the most popular CMSs. The main purpose of CMSmap is to integrate common vulnerabilities for different types of CMSs in a single tool. At the moment, CMSs supported by CMSmap are WordPress,...