CVE-2026-18404

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-71875

The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...

EUVD-2026-71873

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...

CVE-2026-84936 EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat

The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated users to force the site to make repeated billable third-party API requests using the site's own configured API key, and to create an unbounded number of...

CVE-2026-84935 HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84936

The EmbedPress WordPress plugin (versions 4.6.0–4.6.3 ) has a missing-authorization flaw on a public review-loading action. An unauthenticated attacker can force the site to issue repeated billable third-party API requests using the site's own configured API key and to write an unbounded number o...

EUVD-2026-71876

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

CVE-2026-84937

CVE-2026-84937 affects the Video Player for YouTube WordPress plugin in versions before 2.1.0 . The root cause is improper sanitisation and escaping of user-supplied input before it is used in a SQL statement, specifically via the ytp_ajax endpoint. Users with the Contributor role or above can ex...

CVE-2026-84937 YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

EUVD-2026-71874

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84934

CVE-2026-84934 affects the JCH Optimize WordPress plugin before 6.0.1 . The root cause is a missing capability check on an authenticated AJAX action that allows the request to select which internal action runs (specifically a getcacheinfo task override). This lets any authenticated user, includin...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability

Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability discovered by RIA Labs in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

WordPress Video Player for YouTube plugin < 2.1.0 - Contributor+ SQLi vulnerability

Contributor+ SQLi vulnerability discovered by Artus KG in WordPress Plugin YT Player versions 2.1.0...

CVE-2026-84935

CVE-2026-84935 affects the HT Menu WordPress plugin before 1.2.7 . The vulnerability is a Stored XSS caused by the absence of capability or object-ownership checks when saving navigation menu-item settings, combined with missing output escaping when the menu is rendered. This allows low-privilege...

CVE-2026-84934 JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...

CVE-2026-84901

The Eventin WordPress plugin (a.k.a. WP Event Solution) versions before 4.1.22 lack proper authorization checks on several event-management REST routes. Users with contributor-level access or above can change the site's front-page setting to an event they do not own and create, edit, or delete gl...

CVE-2026-84899

The VikWidgetsLoader WordPress plugin before 1.12.0 is vulnerable to a Contributor+ Stored XSS caused by an unsanitised Gutenberg block attribute (class_suffix) being output inside an inline script. Users with the Contributor role can store arbitrary JavaScript that executes in the browser of any...

CVE-2026-84930

CVE-2026-84930 affects the CatFolders Document Gallery & PDF Library WordPress plugin in versions prior to 2.0.7 . The root cause is improper validation of the titleTag block attribute before it is used as an HTML tag name in the plugin's gallery output, enabling a stored XSS attack. Users with t...

WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability

Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.22...

WordPress VikWidgetsLoader plugin < 1.12.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin VikWidgetsLoader versions 1.12.0...