CVE-2026-76128 eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-78576 Readabler < 2.0.18 - Unauthenticated SQL Injection

The Readabler plugin for WordPress is vulnerable to SQL Injection in all versions up to 2.0.18 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append...

EUVD-2026-65357

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-78576

The Readabler plugin for WordPress is vulnerable to SQL Injection in all versions prior to 2.0.18 . The root cause is insufficient escaping of a user-supplied parameter combined with inadequate preparation of an existing SQL query, allowing unauthenticated attackers to append additional SQL state...

CVE-2026-78570

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 2.0.5 . An unauthenticated attacker can elevate their privileges to that of an administrator , resulting in a CVSS 3.1 base score of 9.8 (CRITICAL) with full impact on confidentialit...

EUVD-2026-65358

The Total Donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.5. This makes it possible for unauthenticated attackers to elevate their privileges to that of an adminsitrator...

CVE-2026-78572

The Kalles Addons plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in all versions up to and including 1.0.6 . An unauthenticated attacker can inject a PHP object. No known POP chain exists within the plugin itself, so the vulnerability has no impa...

CVE-2026-77144

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

CVE-2026-77135

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...

CVE-2026-77133

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

EUVD-2026-65343

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups...

CVE-2026-77142

CVE-2026-77142 is a Broken Access Control vulnerability in the TYPO3 extension Industry Directory (yellowpages2) . The frontend self-service editing feature hides the edit form using a template-level visibility flag for company records a visitor does not own, but the corresponding server-side wri...

EUVD-2026-65332

The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event managemen...

EUVD-2026-65324

The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to...

CVE-2026-78568

The Total Donations plugin for WordPress is vulnerable to unauthenticated SQL Injection in all versions up to and including 2.0.5 . The root cause is insufficient escaping on a user-supplied parameter combined with lack of sufficient preparation on the existing SQL query, allowing an attacker to ...

EUVD-2026-65325

The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used...

CVE-2026-78563

The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.1.4 , caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute whenev...

EUVD-2026-65323

The NotificationX Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will...

CVE-2026-18512

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

CVE-2026-18323

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...