CVE-2026-105262 Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation

The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output...

CVE-2026-102499

The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins, in versions before 7.37.0 , are vulnerable to SQL Injection via the mec_attendees AJAX Action . The root cause is the failure to properly sanitise and escape a parameter used within a SQL statement. This allows authe...

CVE-2026-102499 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

CVE-2026-102499 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

EUVD-2026-107049

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

Linux Distros Unpatched Vulnerability : CVE-2026-17025

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Graphene theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'Current location' and 'Author profile image URL' Profile Fields in all versio...

PT-2026-120447

The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output...

PT-2026-120444

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL...

CVE-2023-6985

CVE-2023-6985 10Web AI Assistant – AI content writing assistant = 1.0.18 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description Description The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized...

CVE-2026-93878

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-104811

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-93878

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.2.0 . The root cause is insufficient input sanitization and output escaping within the update_license AJAX Action. This allows authenticated attackers with subscribe...

CVE-2026-93878 DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via updatelicense AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-96903

The Easy Property Listings WordPress plugin, in versions before 3.5.27 , is vulnerable to a sensitive data disclosure flaw. The plugin fails to perform adequate authorisation checks on several of its contact-management read AJAX actions . This oversight allows any authenticated user, even those w...

CVE-2026-96903 Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...

PT-2026-117237

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin...

CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC The InfiniteWP Client plugin for WordPress, in versions up to and including 1.11.1, is vulnerable to a Sensitive Information Exposure flaw. This vulnerability allows authenticated attackers with subscriber-level permissions or above to extract sensitive data,...

CVE-2026-96534

The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins, in versions prior to 7.37.0 , are vulnerable to SQL injection . The flaw occurs because the software fails to properly sanitise and escape a parameter before including it in a SQL statement, specifically via the mec_...

CVE-2026-96534 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges Subscriber and above to perform SQL injection...

CVE-2026-96534 Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_export

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing authenticated users with minimal privileges Subscriber and above to perform SQL injection...