WordPress SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress versions = 0.9.9...

CVE-2026-12400-Exploit

CVE-2026-12400 — FlowForms IDOR: Unauthorized Form Modification Authenticated Contributor+ Insecure Direct Object Reference to Arbitrary Form Modification in FlowForms ≤ 1.1.1 Vulnerability Overview Property| Value ---|--- CVE ID| CVE-2026-12400 CVSS Score| 4.3 — Medium CVSS Vector|...

CVE-2024-3105-PoC

CVE-2024-3105 PoC The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insertphp' shortcode. This is due to the plugin not restricting the usage of the functionality to hig...

CVE-2026-2600-POC

CVE-2026-2600 ElementsKit Elementor Addons $item echo '' . $item'ekittabtitle' . ''; Elementor's editor sanitizes input on the client side, but the REST API endpoint /wp-json/wp/v2/posts/id accepts the elementordata meta field directly and bypasses that layer entirely. An authenticated Contributo...

CVE-2024-3293-Poc

CVE-2024-3293-Poc rtMedia for WordPress, BuddyPress and bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...

CVE-2026-28134

CVE-2026-28134 Exploitation Report JetEngine = 3.7.2 — Authenticated Contributor+ Remote Code Execution via Twig SSTI Date: March 11, 2026 CVSS Score: 8.8 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Plugin: JetEngine = 3.7.2 Plugin Slug: jet-engine CVE: CVE-2026-28134...

CVE-2021-42362

CVE-2021-42362 The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be...

CVE-2026-118500 Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

WordPress Cool FormKit Lite – Advanced Form Builder for Elementor plugin <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cool Formkit Lite versions = 2.7.9...

WordPress JoomSport – for Sports: Team & League, Football, Hockey & more plugin <= 5.7.11 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin JoomSport versions = 5.7.11...

CVE-2026-108366

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenticated Contributor+ Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg block in all versions up to, and including, 2.8.2...

CVE-2026-107710 Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contenttitle' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-108366 easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Authenticated Contributor+ Stored Cross-Site Scripting via the 'icon' attribute of the easyjobs/job-list Gutenberg block in all versions up to, and including, 2.8.2...

WordPress VikRentCar Car Rental Management System plugin <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin VikRentCar versions = 1.4.10...

WordPress Jupiter X Core plugin <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin JupiterX Core versions = 4.61.0...

EUVD-2025-28862

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwplibrary shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

EUVD-2025-26403

The TablePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcodedebug’ parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2026-103480 Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Suphakit Phrmduang TORTY in WordPress Plugin WP Dark Mode versions = 5.3.17...

WordPress VK Blocks plugin <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin VK Blocks versions = 1.126.1...