CVE-2026-118638: Unknown Mapster WP Maps: The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that…

The Mapster WP Maps WordPress plugin before 2.0.6 does not perform any authorization check on a REST API route that writes post data, allowing unauthenticated attackers to overwrite the title of arbitrary posts, create arbitrary published posts, and overwrite the Mapster WP Maps WordPress plugin...

CVE-2026-119162: specialk User Submitted Posts – Enable Users to Submit Posts from the Front End: The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored…

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter in all versions up to, and including, 20260916 due to insufficient input sanitization and output...

CVE-2026-82214: Unknown Quick Event Manager: The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before…

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts...

WordPress User Submitted Posts – Enable Users to Submit Posts from the Front End plugin <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin User Submitted Posts versions = 20260916...

CVE-2026-13747

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

CVE-2024-52433

CVE-2024-52433 My Geo Posts Free = 1.2 - Unauthenticated PHP Object Injection Description The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated...

CVE-2021-42362

CVE-2021-42362 The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the /src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be...

CVE-2026-13747

The Meow Gallery plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 5.5.4 . The root cause is the plugin's failure to properly verify if a user is authorized to perform certain actions via the fetch_posts REST endpoint . This vulnerability allows authent...

EUVD-2026-113731

The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title, content and status of any other user's posts or pages,...

PT-2026-133633

WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to persist unlimited query documents via the Automatic Persisted Query handler. Attackers can send distinct queries with matching SHA-256 queryId values, including...

CVE-2026-13747: tigroumeow Meow Gallery: The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4…

The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-115611

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7...

CVE-2026-115611

The PluginUs.Net TableOn plugin for WordPress is vulnerable to a Reflected Cross-site Scripting (XSS) flaw in the posts-table-filterable component. This vulnerability is caused by improper neutralization of input during web page generation and affects versions from n/a through 1.0.7 . Exploitatio...

EUVD-2026-112738

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7...

CVE-2026-115611 WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7...

CVE-2026-115282

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and...

EUVD-2026-112630

The Photo Engine Media Organizer & Lightroom WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access...

CVE-2026-115282

The Recipe Card Blocks Lite WordPress plugin (versions 2.6.4-3.6.3 ) is vulnerable to an unauthenticated unpublished post content disclosure due to a missing authorization check. The flaw exists within the recipe print feature , which allows attackers to view the title, ID, and content of unpubli...

EUVD-2026-112607

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and...

CVE-2026-115282 Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and...