CVE-2026-101147

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

EUVD-2026-90506

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

WordPress Featured Image from URL (FIFU) Premium plugin 6.8.0-8.2.7 - Administrator Account Creation vulnerability

Administrator Account Creation vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Featured Image from URL FIFU Premium versions 6.8.0-8.2.7...

CVE-2026-101147: Cross-Site Request Forgery (CSRF)

The Featured Image from URL FIFU WordPress plugin before 6.0.8, Featured Image from URL FIFU Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in...

CVE-2026-62078

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-62078

The Premium Addons for Elementor WordPress plugin, in versions

CVE-2026-62078 WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-62078 WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

EUVD-2026-89817

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Premium Addons for Elementor versions = 4.11.105...

WordPress Virtue Premium theme <= 4.10.22 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Patchstack in WordPress Theme Virtue Premium versions = 4.10.22...

WordPress Virtue Premium theme <= 4.10.21 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Patchstack in WordPress Theme Virtue Premium versions = 4.10.21...

CVE-2026-62078: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Coopernicus in WordPress Plugin WPDM – Premium Packages versions = 7.2.1...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-93654 Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-93654 Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-93654

The Premium Packages – Sell Digital Products Securely plugin for WordPress (versions up to and including 7.2.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'cart_items[][product_name]' parameter. Because the ch...

EUVD-2026-86594

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-93654: Improper Neutralization of Input During Web Page Generation

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cartitemsproductname' Parameter in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...