CVE-2026-84930

CatFolders Document Gallery & PDF Library for WordPress, in versions before 2.0.7 , suffers from a stored cross-site scripting (XSS) vulnerability caused by improper validation of the titleTag block attribute before it is used as an HTML tag name in gallery output. Any user with the Author role o...

WordPress Joli Table Of Contents plugin < 3.0.3 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Joli Table Of Contents versions 3.0.3...

CVE-2026-84931

The Joli Table of Contents WordPress plugin (before 3.0.3 ) contains a stored XSS vulnerability in its shortcode handler. The plugin fails to sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute. This allows users with the Author role (or above) t...

EUVD-2026-71871

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as an HTML tag name in its gallery output, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of anyone w...

WordPress Pods plugin 3.3-3.3.9.1 - Author+ Arbitrary File Read vulnerability

Author+ Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Pods versions 3.3-3.3.9.1...

CVE-2026-74853 Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

CVE-2026-74853

The Pods WordPress plugin versions 3.3 through 3.3.9.1 allow users with the author role or above to read arbitrary files from the server—including files outside the web root—because the plugin's display callback does not restrict which functions it may resolve to. The vulnerability only affects s...

EUVD-2026-70903

The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are...

EXPLOIT-CVE-2026-8832

利用漏洞 CVE-2026-8832 一个用于测试WordPress插件WPCode Lite Insert Headers and Footers v2.3.5 中远程代码执行（RCE）漏洞的利用工具。该漏洞源于注册自定义文章类型（CPT）wpcode时未定义自定义capabilitytype。这一疏忽允许任何具有作者角色（或更高）的用户通过XML-RPC在服务器上执行任意PHP代码。 致谢 ：基于 t.me/FanatixLegion 的漏洞分析而创建。 ⚠️ 免责声明 仅限授权安全测试。 未经授权将此工具用于非您拥有的系统是非法的...

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 Una herramienta de explotación para probar vulnerabilidades de Ejecución Remota de Código RCE en el plugin de WordPress WPCode Lite Insert Headers and Footers v2.3.5. Esta vulnerabilidad se origina al registrar el Tipo de Contenido Personalizado CPT wpcode sin definir un...

CVE-2026-77784

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-77788

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

CVE-2025-15663

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

EUVD-2026-69839

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own,...

CVE-2026-77785

The Rank Math SEO WordPress plugin prior to 1.0.277 is vulnerable to an Author+ non-public post content disclosure via its Abilities API . The plugin fails to verify whether the requesting user is permitted to read a specific post before returning its content and SEO metadata, allowing any user w...

CVE-2026-77788

The Rank Math SEO WordPress plugin before 1.0.277 contains an insufficient authorization check in the updateSchemas function. The plugin does not verify that the metadata row being updated belongs to the object the user was authorized against, allowing users with the Author role or higher to over...

CVE-2026-77785 Rank Math SEO < 1.0.277 - Author+ Non-Public Post Content Disclosure via Abilities API

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other user...

CVE-2026-77784

Rank Math SEO (WordPress plugin) versions before 1.0.277 suffer from an authorization bypass in the mark_page_as function: the plugin does not verify that the requesting user is permitted to edit the target object before updating its SEO indexing metadata (Robots and Pillar Content settings). An ...

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery (BEAF) WordPress plugin versions before 4.7.19 are affected by an Author+ Stored XSS . The root cause is that the slider's before-label value is not properly escaped before the plugin's bundled client-side script re-injects it into the DOM. An atta...