EUVD-2026-89631

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-88791 Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path...

CVE-2026-85573 All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's...

CVE-2026-86789

The Connections Business Directory WordPress plugin, in versions up to and including 10.4.67 , fails to enforce visibility and moderation-status restrictions on specific REST API read endpoints (specifically cn-api/v1 routes). This flaw allows unauthenticated attackers to retrieve sensitive infor...

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.67 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability exists because the plugin fails to perform proper capability checks when saving specific fields and lacks sufficient output escaping . Th...

CVE-2026-83560 New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

CVE-2026-85415 Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

EUVD-2026-89633

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed...

WordPress EmbedPress plugin 4.4.9-4.6.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin EmbedPress versions 4.4.9-4.6.6...

WordPress Audio Player Block plugin 1.1.0-1.6.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin Audio Player Block – audio player gutenberg block plugin versions 1.1.0-1.6.2...

WordPress New User Approve plugin 3.1.0-3.2.9 - Unauthenticated PII Disclosure vulnerability

Unauthenticated PII Disclosure vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin New User Approve versions 3.1.0-3.2.9...

CVE-2026-85415

The Audio Player Block WordPress plugin, in versions prior to 1.6.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate the scheme of a user-supplied URL before using it as a link target. This allows users with the Contributor role or higher to store mal...

CVE-2026-80333 Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...

EUVD-2026-89632

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

EUVD-2026-89634

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

CVE-2026-80333 Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve...

CVE-2026-85001 EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-85001 EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed...

CVE-2026-85415 Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CVE-2026-85001

The EmbedPress WordPress plugin (versions before 4.6.7 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to sanitize and escape one of its Elementor widget settings (specifically the showTitle attribute) before it is output into an HTML attribute. This allow...