WordPress Joli Table Of Contents plugin < 3.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Joli Table Of Contents versions 3.0.3...

CVE-2026-84899

VikWidgetsLoader WordPress plugin versions before 1.12.0 contain a stored XSS vulnerability via the Gutenberg Block class_suffix attribute. The plugin fails to sanitise or escape this attribute before outputting it inside an inline script. A user with the Contributor role can inject arbitrary Jav...

EUVD-2026-71867

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

EUVD-2026-71868

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

CVE-2026-84901

Eventin WordPress plugin before version 4.1.22 contains insufficient authorization checks on several of its event-management REST routes. Users with Contributor-level access or above can change the site's front-page setting to an event they do not own and create, edit, or delete global event and ...

CVE-2026-84931

The Joli Table of Contents WordPress plugin (before 3.0.3 ) contains a stored XSS vulnerability in its shortcode handler. The plugin fails to sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute. This allows users with the Author role (or above) t...

EUVD-2026-71871

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

EUVD-2026-71870

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...

WordPress CatFolders Document Gallery & PDF Library plugin < 2.0.7 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin CatFolders Document Gallery & PDF Library versions 2.0.7...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Administrator Email Disclosure vulnerability

Contributor+ Administrator Email Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Google Reviews Modification vulnerability

Contributor+ Google Reviews Modification vulnerability discovered by Artus KG in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

EUVD-2026-71872

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

EUVD-2026-71869

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...

CVE-2026-84927

EmbedPress WordPress plugin versions 4.6.0 through 4.6.3 contain an insufficient authorization check on one of its Google Reviews REST API routes . Users with the Contributor role or above can modify a site-wide store, delete entries previously configured by an administrator, and inject their own...

WordPress King Addons for Elementor plugin < 51.1.77 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin King Addons for Elementor versions 51.1.77...

WordPress The Events Calendar plugin < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability

Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.17.3.1...

WordPress Kirki plugin 6.0.0-6.2.5 - Editor+ SQLi vulnerability

Editor+ SQLi vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Kirki versions 6.0.0-6.2.5...

EUVD-2026-71862

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

CVE-2026-84745

The Events Calendar WordPress plugin (before 6.17.3.1 ) fails to restrict non-public event, venue, and organizer content in its public REST archives. As a result, any authenticated user with a Contributor or higher role can read the full contents of every unpublished record on the site, including...

EUVD-2026-71864

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...