CVE-2026-84935 HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84936

The EmbedPress WordPress plugin (versions 4.6.0–4.6.3 ) has a missing-authorization flaw on a public review-loading action. An unauthenticated attacker can force the site to issue repeated billable third-party API requests using the site's own configured API key and to write an unbounded number o...

EUVD-2026-71876

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

CVE-2026-84937

CVE-2026-84937 affects the Video Player for YouTube WordPress plugin in versions before 2.1.0 . The root cause is improper sanitisation and escaping of user-supplied input before it is used in a SQL statement, specifically via the ytp_ajax endpoint. Users with the Contributor role or above can ex...

CVE-2026-84937 YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

EUVD-2026-71874

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84934

CVE-2026-84934 affects the JCH Optimize WordPress plugin before 6.0.1 . The root cause is a missing capability check on an authenticated AJAX action that allows the request to select which internal action runs (specifically a getcacheinfo task override). This lets any authenticated user, includin...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability

Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability discovered by RIA Labs in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

WordPress Video Player for YouTube plugin < 2.1.0 - Contributor+ SQLi vulnerability

Contributor+ SQLi vulnerability discovered by Artus KG in WordPress Plugin YT Player versions 2.1.0...

CVE-2026-84935

CVE-2026-84935 affects the HT Menu WordPress plugin before 1.2.7 . The vulnerability is a Stored XSS caused by the absence of capability or object-ownership checks when saving navigation menu-item settings, combined with missing output escaping when the menu is rendered. This allows low-privilege...

CVE-2026-84934 JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...

CVE-2026-84901

The Eventin WordPress plugin (a.k.a. WP Event Solution) versions before 4.1.22 lack proper authorization checks on several event-management REST routes. Users with contributor-level access or above can change the site's front-page setting to an event they do not own and create, edit, or delete gl...

CVE-2026-84899

The VikWidgetsLoader WordPress plugin before 1.12.0 is vulnerable to a Contributor+ Stored XSS caused by an unsanitised Gutenberg block attribute (class_suffix) being output inside an inline script. Users with the Contributor role can store arbitrary JavaScript that executes in the browser of any...

CVE-2026-84930

CVE-2026-84930 affects the CatFolders Document Gallery & PDF Library WordPress plugin in versions prior to 2.0.7 . The root cause is improper validation of the titleTag block attribute before it is used as an HTML tag name in the plugin's gallery output, enabling a stored XSS attack. Users with t...

WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability

Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.22...

WordPress VikWidgetsLoader plugin < 1.12.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin VikWidgetsLoader versions 1.12.0...

WordPress Joli Table Of Contents plugin < 3.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Joli Table Of Contents versions 3.0.3...

CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

CVE-2026-84927 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...

CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...