CVE-2026-100508

The WordPress Two Factor plugin versions

CVE-2026-97288

The WordPress OAuth Server plugin, version 4.5.1 and below , is vulnerable to a Cross-Site Scripting (XSS) flaw. The vulnerability is attributed to the Contributor role. While the vulnerability is confirmed, specific technical root causes, exploitation details, or remediation steps are not provid...

CVE-2026-97279

The Polylang plugin for WordPress versions

CVE-2026-97261

The Notivo WordPress plugin (versions

CVE-2026-97261 WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Notivo = 1.4.2 versions...

CVE-2026-97246

The ShortPixel Image Optimizer plugin for WordPress (versions

CVE-2026-97242 WordPress WEBO MCP plugin <= 3.0.18 - Arbitrary File Deletion vulnerability

Author Arbitrary File Deletion in WEBO MCP = 3.0.18 versions...

CVE-2026-97242

The WordPress WEBO MCP plugin versions

CVE-2026-96831 WordPress Themify Builder plugin <= 7.8.1 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Themify Builder = 7.8.1 versions...

CVE-2026-96820 WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Awesome Support = 6.3.9 versions...

CVE-2026-96350 WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Estatik = 4.3.5 versions...

CVE-2026-96347 WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Bookly = 28.2 versions...

CVE-2026-96347

The Bookly WordPress plugin (versions

CVE-2026-96338 WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Profile Builder = 4.0.2 versions...

CVE-2026-94076

The SEO Plugin by Squirrly SEO for WordPress (versions

CVE-2026-94076 WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

EUVD-2026-89831

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

CVE-2026-94076 WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO = 14.2.5 versions...

WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Page Builder by SiteOrigin versions = 2.36.0...

WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Supreme Modules Lite versions = 2.5.63...