EUVD-2026-93555

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...

CVE-2026-66666 WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...

WordPress Core <= 7.1.2 - Contributor+ DoS via infinite loop in WP_Http::make_absolute_url() vulnerability

Contributor+ DoS via infinite loop in WPHttp::makeabsoluteurl vulnerability discovered by Anthropic in WordPress core versions = 7.1.2...

WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability discovered by Ananda Dhakal Patchstack in WordPress core versions = 7.1.2...

WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Theme Traveler versions = 3.2.9...

WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by Rafie Muhammad in WordPress Plugin MainWP Child versions = 6.2.1...

NPM: Payload didn't enforce field-level password update restrictions

NPM: Payload didn't enforce field-level password update restrictions vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

NPM: Payload: ReDoS in Multipart Content-Type Validation

NPM: Payload: ReDoS in Multipart Content-Type Validation vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload vulnerable to API key disclosure through ordinary document reads

NPM: Payload vulnerable to API key disclosure through ordinary document reads vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload relationship-query authorization bypass

NPM: Payload relationship-query authorization bypass vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

NPM: Payload: Token refresh and password reset responses may expose restricted user fields

NPM: Payload: Token refresh and password reset responses may expose restricted user fields vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload: Field access control bypass on auth collections

NPM: Payload: Field access control bypass on auth collections vulnerability discovered by ? in WordPress Npm payload versions 3.0.0, 3.90.0...

NPM: Payload: SQL Injection in SQLite and Postgres

NPM: Payload: SQL Injection in SQLite and Postgres vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.88.0...

NPM: Payload: Untrusted redirect URL parameter exploit

NPM: Payload: Untrusted redirect URL parameter exploit vulnerability discovered by ? in WordPress Npm payload versions = 3.40.0, 3.88.0...

NPM: Payload: Polymorphic join queries could disclose hidden fields

NPM: Payload: Polymorphic join queries could disclose hidden fields vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload: Password hashes use insufficient PBKDF2 iterations

NPM: Payload: Password hashes use insufficient PBKDF2 iterations vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload: Sort queries could expose protected field information

NPM: Payload: Sort queries could expose protected field information vulnerability discovered by ? in WordPress Npm payload versions 3.88.0...

NPM: pbkdf2 rehashes long passwords on every iteration, enabling denial of service

NPM: pbkdf2 rehashes long passwords on every iteration, enabling denial of service vulnerability discovered by ? in WordPress Npm pbkdf2 versions = 3.1.6...

Exploit for CVE-2026-97286

CVE-2026-97286: Authenticated Stored XSS in Strong Testimonial...

WordPress elegro Crypto Payment plugin <= 1.0.1 - Unauthenticated Arbitrary Order Status Change vulnerability

Unauthenticated Arbitrary Order Status Change vulnerability discovered by JunHee CHO in WordPress Plugin elegro Crypto Payment versions = 1.0.1...