CVE-2026-97242

The WordPress WEBO MCP plugin versions

CVE-2026-96831 WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-96820 WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Awesome Support = 6.3.9 versions...

CVE-2026-96350 WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Estatik = 4.3.5 versions...

CVE-2026-96347 WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...

CVE-2026-96347

The Bookly WordPress plugin (versions

CVE-2026-96338 WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Profile Builder = 4.0.2 versions...

CVE-2026-94076 WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

EUVD-2026-89831

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

CVE-2026-94076 WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

CVE-2026-94076

The SEO Plugin by Squirrly SEO for WordPress (versions

WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Page Builder by SiteOrigin versions = 2.36.0...

WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Supreme Modules Lite versions = 2.5.63...

WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin EWWW Image Optimizer versions = 8.7.7...

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

Bypass vulnerability vulnerability discovered by rpgsec in WordPress Plugin OAuth Single Sign On – SSO OAuth Client versions = 7.1.2...

CVE-2026-75098

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin OAuth Server versions = 4.5.1...

EUVD-2026-89721

A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments...

CVE-2026-102582 Moodle: manual enrolment page accessible when plugin disabled

A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Consequently, an authorized user could manage manual enrolments...

WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by gueco in WordPress Plugin Prevent files / folders access versions = 2.6.7...