CVE-2026-18934

The CVE describes a vulnerability in the RSS Aggregator by Feedzy WordPress plugin prior to version 5.2.6 where an unauthorized user with author-level access can manipulate import jobs: they can permanently delete posts created by another user’s import, reset deduplication and scheduling state, d...

CVE-2026-16559

The YMC Filter WordPress plugin (pre-3.12.9) fails to sanitize SVG uploads via its icon upload feature, allowing low-privilege users (Author role+) to upload SVGs containing JavaScript that executes in the site origin when viewed (Stored XSS). A fix is to update to version 3.12.9 or later; otherw...

CVE-2026-15979

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...

CVE-2026-15979

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'imgfile' field within the ceggdata post metadata: the value passe...

CVE-2026-16068

The Brizy WordPress plugin before 2.8.19 has an access-control and input-sanitization flaw: authenticated users with Author-level access and above can modify site-global design data and inject arbitrary JavaScript. This code is stored and served unsanitised on front-end pages, enabling XSS for al...

CVE-2026-16068 Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset

The Brizy WordPress plugin before 2.8.19 does not properly restrict who can modify its site-global design data and does not sanitise part of that data before outputting it, allowing authenticated users with Author-level access and above to store arbitrary JavaScript that is then served unsanitise...

EUVD-2026-51412

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...

CVE-2026-14833

CVE-2026-14833 corresponds to a stored XSS risk in the Lightbox with PhotoSwipe WordPress plugin prior to 5.9.0. The root cause is lack of sanitisation/escaping of a link data attribute when rendering the image lightbox caption, which allows users with author-level access (lacking unfiltered_html...

CVE-2026-14833

The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...

CVE-2026-13330 Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...

CVE-2026-13330

The CVE affects the WordPress plugin Animation Addons for Elementor up to version 2.7.0. The issue is that the plugin does not sanitize uploaded SVG/SVGZ files, and erroneously treats them as allowed upload types. This enables users with the upload_files capability (Author and above) to upload fi...

CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

CVE-2026-13605

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

CVE-2026-12144

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...

EUVD-2026-50097

The Wholesale for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This is due to the saverequestsmeta function applying only sanitizetextfield to the userroleset POST parameter before passing it directly to WPUser::addrole, with ...

CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15425

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Slug postname in all versions up to, and including, 28.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-47906

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asmcode' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-13352 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.18 - Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowedmimetypes function. This is due to the unconditional...

CVE-2026-2594

The Smart Custom Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.7. This is due to insufficient input sanitization and output escaping of uploaded image attachment titles. This makes it possible for authenticated attackers, with...