EUVD-2026-94184

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

EUVD-2026-94185

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...

CVE-2026-104953 MPG < 4.2.3 - Editor+ SQLi via Project Import

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

CVE-2026-104678

The CP Media Player WordPress plugin (versions before 1.3.4 ) is vulnerable to an improper access control flaw in its settings-page handler . Due to a lack of capability checks, users with only Contributor-level access can perform actions reserved for administrators, such as creating, modifying, ...

CVE-2026-104050 Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to rea...

CVE-2026-104652 Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID

The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a...

CVE-2026-104677 WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP

The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content capability that the Editor role holds by default, which allows Editor-level users to save and execute arbitrary PHP code on the server and fully compromi...

CVE-2026-104667 Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can rea...

CVE-2026-104653 Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions

The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any...

CVE-2026-104667

The Animated Number Counters WordPress plugin (versions before 3.1 ) is vulnerable to a second-order SQL injection (CWE-89). The root cause is the failure to sanitize or escape values stored by a user with Editor-level privileges before they are concatenated into a SQL query. This query is execut...

CVE-2026-104652

The Envira Gallery WordPress plugin, in versions prior to 1.16.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitize and escape a gallery item identifier before it is outputted into an image tag attribute . This allows users with the Author role ...

CVE-2026-104653

The Envira Gallery WordPress plugin, in versions prior to 1.16.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitize or escape user-supplied gallery display configuration values before they are stored and subsequently outputted into an image tag ...

CVE-2026-104651

The Yaad Sarig Payment Gateway For WC WordPress plugin, in versions before 2.2.13 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify authorization or ownership of the target order during several order payment-processing actions . This allows any authent...

CVE-2026-104050

The Academy LMS WordPress plugin versions before 4.0.0 is vulnerable to a cross-course quiz answer disclosure. The plugin fails to verify if a quiz question belongs to a course the requesting user is authorized to access before returning the answer options via the render_quiz_answers function. Th...

WordPress Envira Gallery plugin < 1.16.1 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by John Ryan Albon in WordPress Plugin Envira Photo Gallery versions 1.16.1...

WordPress Academy LMS plugin < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure vulnerability

Subscriber+ Cross-Course Quiz Answer Disclosure vulnerability discovered by Morato Antoine in WordPress Plugin Academy LMS versions 4.0.0...

CVE-2026-104667 Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can rea...

CVE-2026-104050 Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers

The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single course, such as an enrolled student, to rea...

CVE-2026-104653 Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions

The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any...

EUVD-2026-94179

The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a...