WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability

Denial of Service Attack vulnerability discovered by dodoh4t in WordPress Plugin WPBase Cache versions = 5.5.6...

WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Graphina – Charts and Graphs For Elementor versions = 3.1.12...

WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin Buddyboss Platform versions = 3.1.0...

WordPress The7 theme <= 14.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bonds in WordPress Theme The7 versions = 14.2.2...

WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Challan versions = 3.7.88...

WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jamaal ahmed in WordPress Plugin ARForms versions = 7.1.2...

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Kim Sang HPT Vietnam in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.4.6...

WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

Settings Change vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions = 3.1.0...

WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Digital Downloads versions = 3.7.1...

CVE-2026-105397

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

CVE-2021-3493_CVE-2022-3357

NOTE 1. This is a GitHub repository containing source code and research information about 2 CVEs: CVE-2021-3493 and CVE-2022-3357, respectively a CVE allowing privilege escalation and a CVE allowing RCE intrusion. If we combine these two CVEs, we can infiltrate a WordPress server and if that serv...

WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Zein in WordPress Plugin Social Rocket versions = 1.3.5...

WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin ListingPro versions = 2.9.12...

WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin SafeSnap – Verified WordPress Backup & Restore versions = 2.1.2...

WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Museder RestoreOne versions = 2.7.276...

WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Norvis Backup versions = 1.1.0...

WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Sitemovr versions = 1.0.1...

WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Snapshotify All-in-One Backup & Restore & Migrate versions = 1.3.2...

WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Tourfic Pro versions = 1.17.3...

EUVD-2026-92444

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...