CVE-2026-85418 Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.9 does not validate a user-supplied HTML tag name in one of its Beaver Builder widgets before echoing it into the rendered markup, allowing users with contributor-level access an...

CVE-2026-85037 Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...

EUVD-2026-74716

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

EUVD-2026-74718

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

WordPress Kirki plugin 6.2.1-6.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.2.1-6.2.5...

WordPress Sunshine Photo Cart plugin < 3.7 - Unauthenticated Price Manipulation vulnerability

Unauthenticated Price Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin Sunshine Photo Cart versions 3.7...

CVE-2026-84222 Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones...

CVE-2026-84222

The Kirki WordPress plugin versions before 6.3.0 (specifically identified as 6.2.1-6.2.5) contains a vulnerability that fails to verify if a requester has permission to read a post before rendering and returning its content. This flaw allows unauthenticated users to retrieve content from non-publ...

CVE-2026-85132 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

EUVD-2026-74715

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

EUVD-2026-74717

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that...

CVE-2026-85132

The WPLP Cookie Consent WordPress plugin (versions 4.0.2-4.4.1 ) is vulnerable to a disclosure of the automated scan schedule. The root cause is a failure to perform nonce or capability checks on a specific cookie scanner AJAX action, specifically via gcc_get_schedule_scan. This allows any authen...

CVE-2026-84113 Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

WordPress Quentn WP plugin < 1.2.15 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Quentn WP versions 1.2.15...

WordPress WPLP Cookie Consent plugin 4.0.2-4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure vulnerability

Subscriber+ Cookie Scan Schedule Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.0.2-4.4.1...

CVE-2026-84113

The Quentn WP WordPress plugin, in versions prior to 1.2.15 , is vulnerable to an SQL injection flaw. The root cause is the insufficient sanitization and escaping of the 'orderby' and 'order' parameters before they are processed in an SQL query. This vulnerability allows high-privilege users, suc...

CVE-2026-85037

The Sunshine Photo Cart WordPress plugin versions before 3.7 is vulnerable to an unauthenticated price manipulation issue. The plugin fails to validate that a client-supplied price identifier corresponds to the specific item being added to the cart. This allows unauthenticated users to purchase i...

CVE-2026-85132 WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any authenticated user, such as a subscriber, to read back the automated scan schedule the administrator configured...

CVE-2026-84113 Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...