WordPress WPMK Block plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin WPMK Block versions = 1.0.1...

WordPress Text Snippets plugin <= 0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by MAJidox in WordPress Plugin Text Snippets versions = 0.0.1...

WordPress Quran Live Multilanguage plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin Quran Live Multilanguage versions = 1.0.3...

WordPress Posts map plugin <= 0.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by MAJidox in WordPress Plugin Posts map versions = 0.1.3...

WordPress Easy Social Photos Gallery – MIF plugin <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Easy Social Photos Gallery – MIF versions = 3.1.2...

WordPress ER Swiffy Insert plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin ER Swiffy Insert versions = 1.0.0...

WordPress Slider Bootstrap Carousel plugin <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin Slider Bootstrap Carousel versions = 1.0.7...

WordPress Switch CTA Box plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Switch CTA Box versions = 1.1...

WordPress Bread & Butter plugin < 8.7.0.139 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Bread & Butter versions 8.7.0.139...

WordPress Twittee Text Tweet plugin <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Twittee Text Tweet versions = 1.0.8...

WordPress AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter vulnerability

WordPress AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin = 11.0.4 - Unauthenticated Arbitrary File Read via 'username' Parameter vulnerability discovered by daroo in WordPress Plugin AcyMailing SMTP Newsletter versions = 11.0.4...

WordPress Post Grid and Gutenberg Blocks plugin 2.3.0-2.3.8 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Chloe Chamberland - Wordfence in WordPress Plugin Post Grid and Gutenberg Blocks versions 2.3.0-2.3.8...

CVE-2026-88876

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources without password validation. Attackers can request t...

EUVD-2026-75421

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...

CVE-2026-88871 WWBN AVideo CustomizeUser setSubscribers CSRF via GET

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...

CVE-2026-88870 WWBN AVideo LoginControl PGP Key CSRF via GET Request

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl plugin PGP key endpoints that lack CSRF token validation. Attackers can craft malicious pages with image tags pointing to savePublicKey.json.php to replace a...

CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

EUVD-2026-75416

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in...

WordPress Sidebar Manager Light plugin <= 1.18 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin Sidebar Manager Light versions = 1.18...

WordPress Redux Framework plugin <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by h0xilo in WordPress Plugin Redux Framework versions = 4.5.13.1...