WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Jamaal ahmed in WordPress Plugin Tourfic Pro versions = 1.17.3...

CVE-2026-105397 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

EUVD-2026-92444

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

CVE-2026-105397

The LearnPress plugin for WordPress (versions through 4.4.9.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of input sanitization in the update_question AJAX handler , which allows authenticated users with the Instructor role to inject malicious scripts v...

CVE-2026-105397 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Jitlada in WordPress Plugin Builderius versions = 1.4-beta...

WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability

SQL Injection vulnerability discovered by johska in WordPress Plugin WP2LEADS versions = 3.5.7...

WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by johska in WordPress Plugin WP2LEADS versions = 3.5.7...

WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Real 3D FlipBook versions = 5.5...

WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by wackydawg in WordPress Plugin Meta Box AIO versions = 3.7.1...

WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ratchanon Chamnankit in WordPress Plugin WP Event Solution versions = 4.1.25...

WordPress File Uploads Addon for WooCommerce plugin 1.7.2-1.7.6 - Unauthenticated Direct File Access vulnerability

Unauthenticated Direct File Access vulnerability discovered by J4ck13Ch4n in WordPress Plugin File Uploads Addon for WooCommerce versions 1.7.2-1.7.6...

WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Kit formerly ConvertKit for WooCommerce versions = 2.2.0...

WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme WPLMS versions = 4.972...

WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ParkHyunWoo in WordPress Plugin Morning for WooCommerce versions = 2.4.1...

WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dodoh4t in WordPress Plugin HTTP Requests Manager versions = 1.3.11...

WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin Database for CF7 versions = 1.2.6...

WordPress Content Visibility for Divi Builder plugin <= 5.03 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by ParkHyunWoo in WordPress Plugin Content Visibility for Divi Builder versions = 5.03...

wp2shell

CVE-2026-63030 + CVE-2026-60137 – „wp2shell“: Unauthenticatede RCE im WordPress-Core Batch-Routen-Verwirrung der REST-API CVE-2026-63030 verknüpft mit einer WPQuery-authornotin-SQL-Injection CVE-2026-60137 → Pre-Auth Remote Code Execution gegen eine Standard-WordPress-Installation. Entdeckt von...

WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Theme EduMall versions = 4.5.3...