CVE-2026-6431

CVE-2026-6431 affects the User Profile Builder WordPress plugin (all versions up to and including 3.15.7 ), which is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) through the 'Biographical Info' meta field parameter. The root cause is insufficient input sanitization and output e...

CVE-2026-8279 Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'deleteitempermissionscheck' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers ...

EUVD-2026-72365

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-12853 Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-12853

The Flamingo plugin for WordPress (versions up to and including 2.6.2 ) is vulnerable to an authorization bypass. The plugin's flamingo_map_meta_cap() filter restricts access to its admin UI but does not extend to WordPress core APIs, specifically XML-RPC wp.getTerms and admin-ajax ajax-tag-searc...

CVE-2026-2390

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

EUVD-2026-72350

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

CVE-2026-2390

The Powerkit WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via its Lazy Load module's image processing in all versions up to and including 3.0.4 . The root cause is the content_process_images function, which relies on a flawed regex-based HTML attribute parser, allowing auth...

WordPress Beaver Builder Plugin (Pro Version) plugin <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter vulnerability

Reflected Cross-Site Scripting via 'noresultsmessage' nodepreview Parameter vulnerability discovered by Austin Ginder - Anchor Hosting in WordPress Plugin Beaver Builder Plugin Starter Version versions = 2.11.0.1...

WordPress iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability discovered by Pham Duc Anh in WordPress Plugin iubenda versions = 3.13.4...

WordPress iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by daroo in WordPress Plugin iubenda versions = 3.13.4...

WordPress WP Fusion (Pro) plugin <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability discovered by Jarno Vos jarnovos in WordPress Plugin WP Fusion Pro versions = 3.47.13...

WordPress Otter Blocks plugin <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass vulnerability

Missing Authorization to Unauthenticated Purchase Verification Bypass vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Otter - Gutenberg Block versions = 3.1.7...

WordPress Masteriyo LMS plugin <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion vulnerability discovered by Jamshed Yergashvoyev CVE Guy - Turan Security in WordPress Plugin Masteriyo - LMS versions = 2.2.0...

WordPress Powerkit plugin <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Powerkit versions = 3.0.4...

PT-2026-86756

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

PT-2026-86751

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-86682

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content process images' function using a flawed regex-based HTML attribute parser. This makes it possible for...

PT-2026-86762

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete item permissions check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attacke...

WordPress Online Scheduling and Appointment Booking System – Bookly plugin <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Plugin Update vulnerability discovered by KoreaInfoSec in WordPress Plugin Bookly versions = 27.2...