CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

CVE-2026-84818 WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

CVE-2026-84817

CVE-2026-84817 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress JetFormBuilder plugin in versions 3.6.5.1 and earlier . The flaw is reachable over the network with low complexity and no prior authentication, though user interaction is required. The CVSS 3.1 s...

CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

CVE-2026-81802

WpEvently (WordPress plugin, also listed as Mage EventPress) versions ≤ 5.6.0 contain an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability. The CVSS 3.1 score is 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating a network-exploitable issue requiring...

CVE-2026-84820 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

CVE-2026-84820 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.17 versions...

CVE-2026-84820

Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin versions

WordPress Jetpack plugin 14.5-16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters

Reflected to Stored Cross-Site Scripting via Reader Repost Parameters vulnerability discovered by Jetpack in WordPress Plugin Jetpack versions 16.1-16.1.2...

WordPress Beaver Builder Page Builder – Drag and Drop Website Builder plugin <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kishan Vyas in WordPress Plugin Beaver Builder versions = 2.10.3.1...

WordPress WPML Multilingual CMS plugin <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection vulnerability

Incorrect Authorization to Authenticated Subscriber+ SQL Injection vulnerability discovered by h0xilo in WordPress Plugin Multilingual CMS versions = 4.9.5...

WordPress Event Tickets and Registration plugin <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update vulnerability

Missing Authorization to Unauthenticated Stripe Credentials Update vulnerability discovered by h0xilo in WordPress Plugin Event Tickets versions = 5.27.4...

PT-2026-86991

Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...

WordPress Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability

Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Event Solution versions = 4.1.22...

WordPress Graphina – Charts and Graphs For Elementor plugin <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin Graphina versions = 3.1.11...

CVE-2026-14444

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-12757

The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...

CVE-2026-14444

CVE-2026-14444 is a Privilege Escalation vulnerability in the WP Fusion (Pro) WordPress plugin, affecting all versions up to and including 3.47.13 . The root cause is insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. Authenticate...

EUVD-2026-72403

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...