CVE-2026-93656

The User Profile Builder plugin for WordPress (versions up to and including 4.0.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field . The root cause is insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can i...

CVE-2026-93656 User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92713 Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

CVE-2026-93654 Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-86593

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to and including 7.2.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'cart_items[][product_name]' parameter. Because the ch...

CVE-2026-92713

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to and including 3.0.2 . The root cause is insufficient file path validation within the upload_image function, specifically failing to adequately restrict access via the file parameter. An au...

CVE-2026-17577 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-17577

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 4.7.42 . The flaw exists in the ssl_zen_messages::getMessages() function, which processes the uri and host parameters. Because the application uses base64_decode() on the output ...

EUVD-2026-86592

The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadimage function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author-lev...

CVE-2026-93747

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.1.6 . The flaw exists in the profile_update action where the raw $_POST['data'] array is copied into a $custom_fields variable; subsequent validation and sanitization functio...

CVE-2026-88996 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

EUVD-2026-86591

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profileupdate action — the raw $POST'data' array is copied into a...

EUVD-2026-86590

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996

The WPForms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.0.2 . The root cause is insufficient input sanitization and output escaping involving the 'page_title' POST Parameter via the {page_title} Smart Tag . An unauthenticated attack...

CVE-2026-93747 wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field

The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versions up to, and including, 3.1.6. This is due to insufficient input sanitization and output escaping in the profileupdate action — the raw $POST'data' array is copied into a...

CVE-2026-96752 Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration

The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-96752

The Zero Spam for WordPress plugin for WordPress (versions up to and including 5.7.10 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the Contact Form 7 integration . An unauthenticated attacker can submit a Conta...

EUVD-2026-86589

The Zero Spam for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration in all versions up to, and including, 5.7.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

WordPress WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings plugin <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion vulnerability

Authenticated Subscriber+ Local File Inclusion vulnerability discovered by lhking in WordPress Plugin WP Maps versions = 4.9.8...