WordPress Material Dashboard plugin <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability

Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Material Dashboard versions = 1.4.10...

WordPress WPFormify – Stripe Payments with Form and Checkout plugin <= 1.1.1 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Legion Hunter in WordPress Plugin WPFormify – Stripe Payments with Form and Checkout versions = 1.1.1...

EUVD-2026-53295

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15452 Smash Balloon Social Photo Feed <= 6.11.3 - Reflected Cross-Site Scripting via REQUEST_URI Query String

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15452

The CVE covers the Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress. Affected software: WordPress plugin versions up to 6.11.3. Vulnerability: Reflected Cross-Site Scripting via REQUEST_URI Query String caused by insufficient input sanitization and output escaping. Impact:...

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.19 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by nthng in WordPress Plugin VikAppointments Services Booking Calendar versions = 1.2.19...

WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...

Malicious code in tailwind-custom-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2 The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at...

MAL-2026-12220 Malicious code in tailwind-animationpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3 src/index.js appends an obfuscated evalatob... block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and...

Exploit for SQL Injection in Wordpress

CVE-2023-6553 PHP File Inclusion Leading to RCE — Backup M...

CVE-2026-7105

The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the getmenucontenteditor function in all versions up to, and including, 1.5.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2026-7726

The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...

CVE-2026-7441

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2026-7444

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...

CVE-2026-7520

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-6639

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-6972

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

CVE-2026-6147

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the restreplacemedia function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload...

CVE-2026-6627

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the...

CVE-2026-6079

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...