CVE-2026-18063 Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-78304

The Job Postings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'positionbutton' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-18063

The Job Postings plugin for WordPress (all versions up to and including 2.8.1 ) is vulnerable to Stored Cross-Site Scripting via the position_button parameter in class-job-add-edit.php, due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level ac...

WordPress MotoPress Hotel Booking plugin <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Hotel Booking Lite versions = 6.2.4...

WordPress Advanced Custom Fields: Extended PRO plugin <= 0.9.2.6 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Tin Pham TF1T, Trong Pham dtro, Hao Ngo in WordPress Plugin Advanced Custom Fields: Extended PRO versions = 0.9.2.6...

CVE-2026-16593

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder Editor and above to perform SQL injection attacks that execute when the affected page is rendere...

CVE-2026-18232

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

CVE-2026-15758

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

EUVD-2026-78296

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-89141

CVE-2026-89141 affects the AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin in all versions up to and including 3.7.7 . The vulnerability is an Insecure Direct Object Reference (IDOR) via the mediaId parameter, caused by missing validation on a user-controlled key. Authenticated a...

CVE-2026-15402

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin (slugged wp-event-solution ) is vulnerable to Stored Cross-Site Scripting (XSS) via the etn_shedule_objective schedule_slot parameter in versions up to and including 4.1.23 . The root cause is insuff...

CVE-2026-15402 Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping...

EUVD-2026-78298

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the PermissionManager::managepermissions function being registered as a callback on WordPress core's...

CVE-2026-89141 AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-75983 Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the PermissionManager::managepermissions function being registered as a callback on WordPress core's...

EUVD-2026-78297

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping...

EUVD-2026-78281

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users...

EUVD-2026-78280

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder Editor and above to perform SQL injection attacks that execute when the affected page is rendere...

WordPress WP Directory Kit plugin <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure vulnerability

Contributor+ Non-Public Listing Field Disclosure vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Directory Kit versions = 1.5.7...

WordPress WP Directory Kit plugin <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure vulnerability

Unauthenticated Unpublished Listing Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions = 1.5.7...