CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-3174

The Event Tickets and Registration plugin for WordPress is affected by a missing capability check on the Stripe OAuth return endpoint in all versions up to and including 5.27.4 . Discovered by researcher h0xilo , the flaw allows an unauthenticated attacker to overwrite the site's Stripe merchant ...

EUVD-2026-72696

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

EUVD-2026-72695

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.18) is vulnerable to PHP Object Injection via deserialization of untrusted input introduced through a shortcode. Authenticated attackers with contributor-level access or above can inject a PHP object. Critically, no known P...

WordPress Wise Chat plugin <= 3.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peng Zhou in WordPress Plugin Wise Chat versions = 3.4...

WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HaiND in WordPress Plugin IMPress for IDX Broker versions = 3.3.0...

WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Plugin IMPress for IDX Broker versions = 3.3.0...

WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin EventON versions = 2.5.7...

WordPress EDD Product Catalog Feed by PixelYourSite plugin <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion vulnerability

Authenticated Subscriber+ Arbitrary Options Deletion vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin EDD Product Catalog Feed by PixelYourSite versions = 1.0.2...

CVE-2026-9331

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

Modular DS - Broken Access Control

Modular DS = 2.5.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-23550 info: name: Modular DS - Broken Access Control author: DhiyaneshDk,l46983284-cpu...

MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting

MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to 3.1.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'mwpsetuppurchaseusername' parameter, letting unauthenticated attacke...

CMP WordPress < 4.0.19 - Broken Access Control

CMP WordPress plugin 4.0.19 contains an arbitrary page layout change caused by insufficient access control in the coming soon page feature, letting unauthenticated users modify the layout, exploit requires no authentication. id: CVE-2022-0188 info: name: CMP WordPress 4.0.19 - Broken Access Contr...

Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution

Advanced Custom Fields: Extended WordPress plugin 0.9.0.5 through 0.9.1.1 contains a remote code execution caused by unsafe use of calluserfuncarray in prepareform function, letting unauthenticated attackers execute arbitrary code remotely. id: CVE-2025-13486 info: name: Advanced Custom Fields...

Atarim < 4.2.2 - Sensitive Information Exposure

Vito Peleg Atarim = 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges. id: CVE-2025-60188 info: name: Atarim...

CVE-2026-9331 EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

CVE-2026-9331

The EDD Product Catalog Feed WordPress plugin by PixelYourSite is affected in all versions up to and including 1.0.2 . The root cause is a missing capability check on the wpeddpcf_delete_feed function, allowing any authenticated user with subscriber-level access or higher to delete arbitrary Word...

EUVD-2026-72677

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...