CVE-2026-107321

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary...

CVE-2026-104899

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'designtype' parameter parameter. This makes it possible for unauthenticated attackers to include and...

CVE-2026-104763

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

EUVD-2026-96127

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary...

CVE-2026-107321

The W3 Total Cache WordPress plugin, in versions prior to 2.10.6 , is vulnerable to a path traversal flaw during the media-import process. The plugin fails to confine file copies to the document root and lacks effective file-type restrictions. This allows users with Author privileges or higher to...

CVE-2026-105989 Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments...

CVE-2026-104752

The Rank Math SEO WordPress plugin, in versions prior to 1.0.280 , is vulnerable to remote code execution (RCE) . The root cause is an unrestricted upload of file with dangerous type (CWE-434) within the settings import feature, which fails to correctly validate the type of uploaded files. This a...

CVE-2026-104752 Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import feature, allowing users with administrator-level access to upload a PHP file and achieve remote code execution...

CVE-2026-17025

A flaw was found in graphene. Due to insufficient input sanitization and output escaping in user profile fields, an authenticated attacker with low-level privileges can conduct stored Cross-Site Scripting XSS attacks. By injecting malicious scripts into profile fields, an attacker can execute...

EUVD-2026-96107

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-96100

The Church Admin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-104763 Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

CVE-2026-104763

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.17.1 . An authenticated attacker with administrator-level access can perform an arbitrary file read by exploiting the file_path parameter within a media_metadata.json ...

EUVD-2026-96096

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'filepath' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

CVE-2026-83526 FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the checkmimetype function. This is due to insufficient file type validation in checkmimetype, which writes attacker-supplied remote file content to the public uploads...

CVE-2026-83526

The FV Player 8 plugin for WordPress (versions

EUVD-2026-96092

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the checkmimetype function. This is due to insufficient file type validation in checkmimetype, which writes attacker-supplied remote file content to the public uploads...

CVE-2026-83526 FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the checkmimetype function. This is due to insufficient file type validation in checkmimetype, which writes attacker-supplied remote file content to the public uploads...

CVE-2026-97670

The Avada Fusion Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field valu...

EUVD-2026-96051

The Avada Fusion Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field valu...