EUVD-2026-91894

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

EUVD-2026-91892

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-91891

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via ppressbillingaddress Filename Parameter in all versions up to, and including, 4.17.4 due to insufficie...

CVE-2026-92536

The ProfilePress plugin for WordPress (all versions up to and including 4.17.4 ) is vulnerable to Sensitive Information Exposure via the get_user_profile_structure function. Authenticated attackers with subscriber-level access or higher can extract other users' email addresses, login names, and r...

EUVD-2026-91890

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...

CVE-2026-92551

The ProfilePress plugin for WordPress (all versions up to and including 4.17.4 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the ppress_billing_address Filename Parameter. Unauthenticated attackers can inject arb...

CVE-2026-95865

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fieldsvalue' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-93428

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

CVE-2026-94378

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-94539

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sortby' parameter in all versions up to, and including, 3.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-96270

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formid' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and...

CVE-2026-100180

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-13157

CVE-2026-13157 Theme Demo Import false при обработке загрузки. Аутентифицированный пользователь, обладающий правами импорта — например, администратор сайта по умолчанию или администратор сайта, не являющийся суперадминистратором, в архитектуре WordPress Multisite — может обойти ограничения на...

WP2Shell-CVE-2026-63030-POC

WP2Shell Detector and Validation PoC CVE coverage: CVE-2026-63030 and CVE-2026-60137 Intended use: Authorized security testing, defensive validation, and disposable localhost labs only WP2Shell is a WordPress Core vulnerability chain combining a pre-authentication REST API batch-route confusion b...

CVE-2025-28915

CVE-2025-28915 - WordPress ThemeEgg ToolKit Arbitrary File Upload Exploit 📌 Description An Unrestricted File Upload vulnerability in the ThemeEgg ToolKit plugin for WordPress versions ≤ 1.2.9 allows authenticated attackers to upload web shells to the server. This can lead to remote code execution...

CVE-2024-5932

PoC for CVE-2024-5932 Credit goes to: https://github.com/EQSTLab/CVE-2024-5932 https://www.rcesecurity.com/2024/08/wordpress-givewp-pop-to-rce-cve-2024-5932/ This PoC is provided for educational purposes only. I do not take any responsibility for the improper use of this code, especially in...

CVE-2026-93428 Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...

CVE-2026-93428

The Ultimate Member plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 2.13.1 . The root cause is the plugin's failure to properly verify user authorization when accessing the publicly available wp_ajax_nopriv_um_get_members endpoint. Specifically, t...

CVE-2026-93428 Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to...