CVE-2026-84937

CVE-2026-84937 affects the Video Player for YouTube WordPress plugin in versions before 2.1.0 . The plugin fails to properly sanitise and escape user-supplied input before using it in a SQL statement within the ytp_ajax endpoint. Users with the Contributor role or above can exploit this to perfor...

EUVD-2026-71876

The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQL statement, allowing users with the Contributor role and above to perform SQL injection attacks and read arbitrary data from the database...

CVE-2026-84935

HT Menu WordPress plugin, versions before 1.2.7 , is affected by a Stored XSS vulnerability. The plugin fails to enforce a capability or object-ownership check when saving navigation menu-item settings and does not escape those values during menu rendering. As a result, any user with Subscriber p...

CVE-2026-84934

JCH Optimize WordPress plugin before 6.0.1 contains a missing capability check on an authenticated AJAX action that also permits the request to select which internal task executes. This allows any authenticated user (as low as Subscriber ) to import arbitrary plugin settings and store a script th...

WordPress Video Player for YouTube plugin < 2.1.0 - Contributor+ SQLi vulnerability

Contributor+ SQLi vulnerability discovered by Artus KG in WordPress Plugin YT Player versions 2.1.0...

WordPress EmbedPress plugin 4.6.0-4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability

Unauthenticated Google Reviews API Quota Consumption and Database Bloat vulnerability discovered by RIA Labs in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...

EUVD-2026-71874

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permissions such as Subscribers to store JavaScript that...

CVE-2026-84926

EmbedPress WordPress plugin (versions 4.6.0–4.6.3) contains an access-control flaw in one of its Google Reviews REST routes . The route is not properly restricted to administrators, so any authenticated user with contributor-level access or above can read the site administrator's email address—a ...

CVE-2026-84899

VikWidgetsLoader WordPress plugin versions before 1.12.0 contain a stored XSS vulnerability via the Gutenberg Block class_suffix attribute. The plugin fails to sanitise or escape this attribute before outputting it inside an inline script. A user with the Contributor role can inject arbitrary Jav...

CVE-2026-84901

Eventin WordPress plugin before version 4.1.22 contains insufficient authorization checks on several of its event-management REST routes. Users with Contributor-level access or above can change the site's front-page setting to an event they do not own and create, edit, or delete global event and ...

CVE-2026-84930

CatFolders Document Gallery & PDF Library for WordPress, in versions before 2.0.7 , suffers from a stored cross-site scripting (XSS) vulnerability caused by improper validation of the titleTag block attribute before it is used as an HTML tag name in gallery output. Any user with the Author role o...

WordPress VikWidgetsLoader plugin < 1.12.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin VikWidgetsLoader versions 1.12.0...

WordPress Joli Table Of Contents plugin < 3.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Joli Table Of Contents versions 3.0.3...

EUVD-2026-71867

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

EUVD-2026-71868

The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...

WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability

Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event SOlution versions 4.1.22...

CVE-2026-84931

The Joli Table of Contents WordPress plugin (before 3.0.3 ) contains a stored XSS vulnerability in its shortcode handler. The plugin fails to sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute. This allows users with the Author role (or above) t...

EUVD-2026-71870

The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...

WordPress CatFolders Document Gallery & PDF Library plugin < 2.0.7 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin CatFolders Document Gallery & PDF Library versions 2.0.7...

EUVD-2026-71871

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...