CVE-2026-15889

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-15889 Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

EUVD-2026-75366

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-15889 Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-15889

The Aruba HiSpeed Cache WordPress plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.0.14 , caused by insufficient input sanitization and output escaping in the Post Content field. An authenticated attacker with Contributor-level access o...

EUVD-2026-75365

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399 Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the usermetasave function which only sanitizes array values, not scalar...

CVE-2026-5399

The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...

WordPress WP Express Checkout plugin < 2.5.0 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by ryan zegar in WordPress Plugin WP Express Checkout Accept PayPal Payments versions 2.5.0...

WordPress CleanTalk plugin < 6.87 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk versions 6.87...

WordPress SupportCandy plugin 3.2.9-3.5.2 - Unauthenticated Ticket Attachment Disclosure vulnerability

Unauthenticated Ticket Attachment Disclosure vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin SupportCandy versions 3.2.9-3.5.2...

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.26 - Subscriber+ Stored Payment Method Assignment vulnerability

Subscriber+ Stored Payment Method Assignment vulnerability discovered by m1w34p0n & krypt3d in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.26...

WordPress iTracker360 plugin <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itrackerlicense' Settings Field vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin iTracker360 versions = 2.2.0...

WordPress Quentn WP plugin 1.2.13-1.2.14 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Quentn WP versions 1.2.13-1.2.14...

Exploit for SQL Injection in Wordpress

wp2shell Lab — CVE-2026-60137 & CVE-2026-63030 WordPress Core...

CVE-2026-81431

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-77771

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...

CVE-2026-82925

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...

CVE-2026-19840

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

CVE-2026-77770

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...