CVE-2026-84898

CVE-2026-84898 affects the Eventin WordPress plugin in versions prior to 4.1.21 . The root cause is improper validation of a template path value (Event Layout Meta) before it is used in a local file include, enabling users with contributor-level access or higher to include and execute arbitrary l...

CVE-2026-84221

CVE-2026-84221 affects the Kirki WordPress plugin, versions 6.0.0 through 6.2.5 . The vulnerability is an SQL injection caused by an unescaped user-supplied identifier used in a SQL query within the Content Manager Field ID . Any authenticated user with editor-level access or higher can append ar...

WordPress Kirki plugin 6.0.0-6.2.5 - Authenticated Collaboration Comment Status Modification vulnerability

Authenticated Collaboration Comment Status Modification vulnerability discovered by Revanth Meesala in WordPress Plugin Kirki versions 6.0.0-6.2.5...

CVE-2026-84225

CVE-2026-84225 affects the Kirki WordPress plugin versions 6.0.0 through 6.2.5 . The vulnerability is an IDOR (Insecure Direct Object Reference) in the collaboration comment feature: the plugin does not verify that a user is authorized to act on a collaboration comment before changing its state. ...

EUVD-2026-71866

The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...

EUVD-2026-71863

The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cann...

WordPress Eventin plugin < 4.1.21 - Contributor+ LFI vulnerability

Contributor+ LFI vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event SOlution versions 4.1.21...

EUVD-2026-71865

The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...

CVE-2026-84896

CVE-2026-84896 affects the King Addons for Elementor WordPress plugin in versions prior to 51.1.77 . The vulnerability is a Stored XSS in the Magazine Grid Widget , caused by an unescaped widget display-style setting being output in an HTML attribute. Any user with Contributor role or higher can ...

EUVD-2026-71858

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response...

EUVD-2026-71861

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

WordPress Greenshift plugin < 13.2.0 - Contributor+ SSRF vulnerability

Contributor+ SSRF vulnerability discovered by Alireza Kalhor in WordPress Plugin Greenshift versions 13.2.0...

WordPress Bold Page Builder plugin < 5.9.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Bold Page Builder versions 5.9.8...

CVE-2026-83544

Greenshift WordPress plugin versions before 13.2.0 contain a stored cross-site scripting (XSS) vulnerability in the block animation customProps attribute. The attribute is not properly escaped before being output within an HTML attribute context, allowing any authenticated user with Contributor l...

CVE-2026-84022

The Bold Page Builder WordPress plugin before 5.9.8 fails to properly sanitise and escape several shortcode attributes before outputting them in HTML, resulting in a stored XSS . Users with the Contributor role or above can inject arbitrary web scripts that execute when another user views the aff...

EUVD-2026-71859

The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

WordPress Greenshift plugin < 13.2.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Greenshift versions 13.2.0...

CVE-2026-84021

CVE-2026-84021 affects the Bold Page Builder WordPress plugin prior to version 5.9.8 . The vulnerability is a stored cross-site scripting (XSS) caused by improper validation of a link URL before it is output in an HTML attribute. The plugin relies on a filter that an attacker can evade to inject ...

EUVD-2026-71860

The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...

WordPress Bold Page Builder plugin < 5.9.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Md. Minaruzzaman Shovon in WordPress Plugin Bold Page Builder versions 5.9.8...