CVE-2026-15439 GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection

The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...

XSS2Shell-CVE-2026-64638

🔍 @Mr-LeonardoGomes 💀 XSS2Shell-CVE-2026-64638 Escáner multiobjetivo XSS2Shell Desarrollador: Crédito: YogaGymn Utilidad PoC/escaneo para pruebas de seguridad autorizadas en WordPress. El proyecto contiene un flujo de explotación para un único objetivo y un modo solo escaneo multiobjetivo...

WordPress WP-Members Membership Plugin plugin <= 3.5.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WP-Members versions = 3.5.6...

WordPress Registration Form for WooCommerce plugin 1.1.0-1.1.2 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Registration Form for WooCommerce versions 1.1.0-1.1.2...

WordPress Gutenverse News plugin < 3.3.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons versions 3.3.3...

WordPress Advanced Customized Prompts plugin <= 1.0.1 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

WordPress MultiVendorX plugin 5.0.0-5.0.15 - Store Owner+ Privilege Escalation to Administrator vulnerability

Store Owner+ Privilege Escalation to Administrator vulnerability discovered by Philipp Doblhofer in WordPress Plugin MultiVendorX versions 5.0.0-5.0.15...

WordPress Visualizer plugin < 4.0.6 - Contributor+ Arbitrary Chart Deletion vulnerability

Contributor+ Arbitrary Chart Deletion vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Visualizer versions 4.0.6...

WordPress WPCafe plugin 3.0.10-3.0.17 - Unauthenticated Order Disclosure and Modification vulnerability

Unauthenticated Order Disclosure and Modification vulnerability discovered by Artus KG in WordPress Plugin WPCafe versions 3.0.10-3.0.17...

WordPress Persian Elementor plugin 2.7.10-2.8.1 - Unauthenticated ZarinPal Payment Callback Authority Bypass vulnerability

Unauthenticated ZarinPal Payment Callback Authority Bypass vulnerability discovered by Artus KG in WordPress Plugin المنتور فارسی versions 2.7.10-2.8.1...

WordPress miniOrange 2FA plugin 18.0-19.2 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Osman Hussein in WordPress Plugin miniOrange's Google Authenticator versions 18.0-19.2...

WordPress miniOrange 2FA plugin 5.3.24-6.3.0 - Unauthenticated Arbitrary Option Deletion vulnerability

Unauthenticated Arbitrary Option Deletion vulnerability discovered by Osman Hussein in WordPress Plugin miniOrange's Google Authenticator versions 5.3.24-6.3.0...

WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...

WordPress Teddy Bear Customize Addon plugin <= 1.0.5 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Teddy Bear Customize Addon versions = 1.0.5...

WordPress Advanced Customized Prompts plugin <= 1.0.1 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

WordPress miniOrange 2FA plugin 18.0-19.2 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by pervinzahidli in WordPress Plugin miniOrange's Google Authenticator versions 18.0-19.2...

WordPress miniOrange 2FA plugin 6.2.8-6.3.0 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by pervinzahidli in WordPress Plugin miniOrange's Google Authenticator versions 6.2.8-6.3.0...

CVE-2026-89256

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin where chapter names are not encoded before being concatenated into public watch-page HTML. A video owner can inject malicious scripts via the bookmark name...

CVE-2026-89255

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

CVE-2026-89254

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the fieldname parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute...