WP < 7.1.3 - Contributor+ Stored XSS via Imgur Embed

Description WordPress does not escape some of the HTML returned by a trusted third-party oEmbed provider before outputting it in some cases, which could allow users with Contributor-level access and above to perform Stored Cross-Site Scripting attacks through a crafted embed...

WP < 7.1.3 - Author+ Sticky Post via REST API

Description WordPress does not correctly verify user capabilities before allowing a post to be set as sticky via the REST API in some cases, which could allow users with Author-level access and above to feature their own posts on the site front page, an action intended to require higher privilege...

CVE-2026-39775: Incorrect Privilege Assignment

Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme = 2.2 versions...

CVE-2026-39752: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Deletion in Jobs for WordPress = 2.8.2 versions...

PT-2026-106385

Subscriber Broken Access Control in Delete All Comments of wordpress = 7.1 versions...

PT-2026-106405

Name of the Vulnerable Software and Affected Versions Kognetiks Chatbot for WordPress versions prior to 2.5.0 Description An unauthenticated arbitrary file upload issue exists in the Kognetiks Chatbot for WordPress plugin. This allows an attacker to upload files to the server without requiring...

CVE-2026-94299: Incorrect Authorization

The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbitrary orders on any installation where...

PT-2026-106338

Name of the Vulnerable Software and Affected Versions Deema Payment Gateway versions prior to 1.1.3 Description The Deema Payment Gateway WordPress plugin fails to verify the authenticity of incoming payment provider notifications. Because this verification is disabled by default, unauthenticated...

CVE-2026-66666: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...

PT-2026-106340

Name of the Vulnerable Software and Affected Versions File Media Renamer versions prior to 1.4 Description The File Media Renamer WordPress plugin fails to verify if the requesting user is authorized to modify a specific media attachment. This allows any user with file-upload privileges to rename...

PT-2026-106426

Contributor Arbitrary File Deletion in Jobs for WordPress = 2.8.2 versions...

CVE-2026-89289: Missing Authorization

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

PT-2026-106834

Name of the Vulnerable Software and Affected Versions WordPress versions 6.6 through 6.6.9 WordPress versions 6.7 through 6.7.9 WordPress versions 6.8 through 6.8.10 WordPress versions 6.9 through 6.9.9 WordPress versions 7.0 through 7.0.6 WordPress versions 7.1 through 7.1.2 Description An issue...

WP < 7.1.3 - Unauthenticated Private Post Comment Disclosure via RSS Feed

Description WordPress does not properly restrict access to the comments associated with private and unpublished posts in some cases, which could allow unauthenticated users to read those comments through a feed...

CVE-2026-86786: Exposure of Sensitive Information to an Unauthorized Actor

The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as wel...

CVE-2026-32579: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress = 2.4.9 versions...

VulnCheck KEV: CVE-2026-94504

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

VulnCheck KEV: CVE-2026-93836

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-41559: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore = 2.1.2 versions...

WP < 7.1.3 - Unauthenticated Stored XSS via Comment Moderation

Description WordPress does not properly sanitize and escape some malformed comment content in some cases, which could allow unauthenticated users to store comments that perform Stored Cross-Site Scripting attacks in the context of an administrator moderating them...