CVE-2026-80514

The wpForo Forum WordPress plugin (versions 3.0.0 through 3.1.5 ) is vulnerable to unauthenticated AI credit exhaustion . The root cause is a failure to verify the source of client-supplied IP address headers, which are used to key the per-visitor rate limit on paid AI requests. An attacker can b...

EUVD-2026-86626

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

CVE-2026-80514 wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests, allowing unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site...

POC-WP-XSS2Shell-CVE-2026-64638

XSS2Shell — CVE-2026-64638 的 PoC 关于 XSS2Shell （CVE-2026-64638）攻击链的教育性概念验证（PoC）， 这是 pwn.ai 自主发现并于 2026 年 8 月 7 日披露的 WordPress Core 预认证 XSS → RCE 漏洞。 目录 1. 执行摘要 2. 法律声明 3. 攻击链架构 4. 环境要求 5. 仓库结构 6. 快速使用指南 7. 利用验证 8. 补充文档 执行摘要 CVE-2026-64638 是 WordPress 登录界面（wp-login.php）中一个预认证的反射型 跨站脚本...

WordPress Bookly plugin < 28.3 - Unauthenticated Customer PII Update vulnerability

Unauthenticated Customer PII Update vulnerability discovered by Artus KG in WordPress Plugin Bookly versions 28.3...

CVE-2026-86837

The Bookly WordPress plugin versions prior to 28.3 contains a vulnerability where it fails to properly verify a customer's identity during personal information updates. An unauthenticated attacker who possesses a customer's primary identifier can exploit this verification bypass to overwrite sens...

CVE-2026-86837 Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address...

EUVD-2026-86621

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address...

CVE-2026-94573

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-95866

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-95864

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cssfonts' Parameter in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-96568

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96752

The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-93656

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-93747

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profileupdate action — the raw $POST'data' array is copied into a...

CVE-2026-93901

The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-92713

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

CVE-2026-17577

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-88996

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...