WordPress Wise Chat plugin <= 3.4.1 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Peng Zhou in WordPress Plugin Wise Chat versions = 3.4.1...

WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by HaiND in WordPress Plugin IMPress for IDX Broker versions = 3.3.0...

WordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HaiND in WordPress Plugin IMPress for IDX Broker versions = 3.3.0...

WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin EventON versions = 2.5.7...

WordPress EDD Product Catalog Feed by PixelYourSite plugin <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion vulnerability

Authenticated Subscriber+ Arbitrary Options Deletion vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin EDD Product Catalog Feed by PixelYourSite versions = 1.0.2...

WordPress JetFormBuilder plugin < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin JetFormBuilder versions 3.6.5.2...

WordPress B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More plugin < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass vulnerability

Unauthenticated B2B Group Assignment and Approval Bypass vulnerability discovered by Farid Narimanov in WordPress Plugin B2BKing versions 5.2.40...

CVE-2026-9331

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

Modular DS - Broken Access Control

Modular DS = 2.5.1 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions. id: CVE-2026-23550 info: name: Modular DS - Broken Access Control author: DhiyaneshDk,l46983284-cpu...

MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting

MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to 3.1.2 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in 'mwpsetuppurchaseusername' parameter, letting unauthenticated attacke...

CMP WordPress < 4.0.19 - Broken Access Control

CMP WordPress plugin 4.0.19 contains an arbitrary page layout change caused by insufficient access control in the coming soon page feature, letting unauthenticated users modify the layout, exploit requires no authentication. id: CVE-2022-0188 info: name: CMP WordPress 4.0.19 - Broken Access Contr...

Advanced Custom Fields Extended < 0.9.2 - Remote Code Execution

Advanced Custom Fields: Extended WordPress plugin 0.9.0.5 through 0.9.1.1 contains a remote code execution caused by unsafe use of calluserfuncarray in prepareform function, letting unauthenticated attackers execute arbitrary code remotely. id: CVE-2025-13486 info: name: Advanced Custom Fields...

Atarim < 4.2.2 - Sensitive Information Exposure

Vito Peleg Atarim = 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges. id: CVE-2025-60188 info: name: Atarim...

CVE-2026-9331 EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

CVE-2026-9331

The EDD Product Catalog Feed WordPress plugin by PixelYourSite is affected in all versions up to and including 1.0.2 . The root cause is a missing capability check on the wpeddpcf_delete_feed function, allowing any authenticated user with subscriber-level access or higher to delete arbitrary Word...

EUVD-2026-72677

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

CVE-2026-9331 EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

Exploit for CVE-2026-19949

CVE-2026-19949 — Prueba de concepto documentada y reproducible...

Exploit for CVE-2026-8732

CVE-2026-8732 — WP Maps Pro Unauthenticated Admin Creation E...

WordPress Kirki plugin 6.2.1-6.2.5 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Kirki versions 6.2.1-6.2.5...