CVE-2026-89236 SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database...

EUVD-2026-91948

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...

CVE-2026-91078 TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

EUVD-2026-91944

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing...

CVE-2026-94239 Loco Translate < 2.8.9 - Translator+ Stored XSS via Bundle Configuration

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...

EUVD-2026-91942

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

CVE-2026-86832 MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-88783

The Kubio AI Page Builder WordPress plugin, in versions prior to 2.9.3 , is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is that the plugin fails to restrict the expansion of allowed HTML elements solely to the editor context; instead, the wider set of allowed ...

CVE-2026-86832

The MetForm WordPress plugin, specifically versions before 4.3.1 , contains a vulnerability where it fails to properly restrict access to form submission data. This flaw allows unauthenticated attackers to view sensitive submitter information via the REST API . Exploitation details are not provid...

CVE-2026-86834 MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

WordPress MetForm plugin < 4.3.1 - Unauthenticated Form Entry Data Disclosure vulnerability

Unauthenticated Form Entry Data Disclosure vulnerability discovered by Shirshak in WordPress Plugin Metform versions 4.3.1...

EUVD-2026-91941

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

EUVD-2026-91939

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-86832 MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API...

CVE-2026-86834

The MetForm WordPress plugin (versions 2.2.1 through 4.3.0) contains a vulnerability where it fails to properly restrict access to a debug file written to the web root. This occurs during every form submission when the HubSpot Forms integration is enabled. Consequently, unauthenticated attackers ...

CVE-2026-88782 Kubio AI Page Builder < 2.9.3 - Contributor+ Stored XSS via Image Gallery Item URL Attribute

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an...

CVE-2026-88782

The Kubio AI Page Builder WordPress plugin, in versions prior to 2.9.3 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a failure to validate the URI scheme of user-supplied values before they are output as link targets, specifically within the Image Gallery Item UR...

EUVD-2026-91940

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers an...

EUVD-2026-91934

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypass two-factor authentication, including on...