EUVD-2026-60795

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-66644 WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66641 WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...

CVE-2026-66627

The WordPress GP Premium plugin (versions ≤ 2.5.5) allows contributors to upload arbitrary files, enabling potential remote code execution, data theft, or site defacement. CVSS 9.9 (Critical) reflects network-accessible, low-complexity exploitation with low privileges required. Update to the late...

CVE-2026-66621 WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

EUVD-2026-60901

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

EUVD-2026-60893

Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...

CVE-2026-28192

The Piotnet Addons For Elementor Pro WordPress plugin (versions ≤ 7.1.67) allows unauthenticated arbitrary file upload, enabling remote code execution with CVSS 9.6 (Critical). Patchstack assigned PT-2026-77033; CISA SSVC rates technical impact as total with no known exploitation yet. Upgrade bey...

CVE-2026-28192 WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Contact Form by Supsystic versions 1.10.0...

WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin URL Shortify versions = 2.5.0...

WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Typing Effect versions = 1.3.7...

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Tab Widget versions = 1.2.11...

WordPress Link Library plugin <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter vulnerability

Unauthenticated Arbitrary File Deletion via linkurl Parameter vulnerability discovered by nudien in WordPress Plugin Link Library versions = 7.9.4...

PT-2026-77107

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

PT-2026-77088

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

PT-2026-77067

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Subscribe2 versions = 10.46...