EXPLOIT-CVE-2026-8832

EXPLOIT CVE-2026-8832 An exploitation tool to test for Remote Code Execution RCE vulnerabilities in the WordPress plugin WPCode Lite Insert Headers and Footers v2.3.5. This vulnerability stems from registering the Custom Post Type CPT wpcode without defining a custom capabilitytype. This oversigh...

WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API

Description WordPress does not validate the target post when a comment or note is moved to another post through the REST API in some cases, which could allow users with a role as low as author to attach their own notes to posts they are not allowed to edit...

WP < 7.1.1 - Author+ Path Traversal via Templates REST API

Description WordPress does not properly validate template identifiers passed to a REST API endpoint in some cases, which could allow users with a role as low as author to read HTML files outside of the themes directory via path traversal...

WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen

Description WordPress does not check that the user is allowed to read an attachment's parent post before displaying its title on an admin screen in some cases, which could allow users with a role as low as author to learn the title of a private or draft post they cannot access...

CVE-2026-54506

Vvveb CMS prior to 1.0.8.5 is affected by a stored XSS vulnerability in the user profile bio field. The root cause lies in sanitizeHTML() in system/functions.php, where the on* event-handler regex omits the forward-slash delimiter and the do-while loop compares the string to itself, causing forbi...

CVE-2026-87836

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user, allowing users with the Author role and above to retrieve every comment on the site, including commente...

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 An exploitation tool to test for Remote Code Execution RCE vulnerabilities in the WordPress plugin WPCode Lite Insert Headers and Footers v2.3.5. This vulnerability stems from registering the Custom Post Type CPT wpcode without defining a custom capabilitytype. This oversigh...

WordPress Advanced Popups plugin <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability

Authenticated Author+ Stored Cross-Site Scripting via 'Notification Button Link' Field vulnerability discovered by Nguyen Cong Quang in WordPress Plugin Advanced Popups versions = 1.2.3...

WordPress PublishPress Authors plugin <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin PublishPress Authors versions = 4.15.0...

CVE-2026-80071 User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Administrator

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escala...

WordPress Easy Google Fonts plugin <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Kitch in WordPress Plugin Easy Google Fonts versions = 2.0.4...

WordPress Graphina – Charts and Graphs For Elementor plugin <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin Graphina versions = 3.1.11...

CVE-2026-84930

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

CVE-2026-84930

CVE-2026-84930 affects the CatFolders Document Gallery & PDF Library WordPress plugin in versions prior to 2.0.7 . The root cause is improper validation of the titleTag block attribute before it is used as an HTML tag name in the plugin's gallery output, enabling a stored XSS attack. Users with t...

CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

WordPress Joli Table Of Contents plugin < 3.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Joli Table Of Contents versions 3.0.3...

CVE-2026-84930 CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block Attribute

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

EUVD-2026-71871

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

CVE-2026-84931

CVE-2026-84931 affects the Joli Table Of Contents WordPress plugin in versions prior to 3.0.3 . The root cause is a missing sanitisation/escape of a shortcode attribute value before output inside an HTML element's attribute, enabling a stored XSS . Users with the Author role or higher can inject ...

PT-2026-86355

🚨 CVE-2026-84930 The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the...