CVE-2026-87761

The Adwised Web Push Notification WordPress plugin, in versions through 2.5.7 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is a lack of capability or nonce checks when allowing authenticated users to overwrite site-wide configurations, combined with a failure to es...

CVE-2026-93550: Unrestricted Upload of File with Dangerous Type

The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress...

CVE-2026-78530

Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...

CVE-2026-40802

Subscriber Settings Change in Pubjet | پاب‌جت = 5.4.8 versions...

CVE-2026-40805

Subscriber Arbitrary File Deletion in PeepSo = 9.0.5.4 versions...

CVE-2026-40800

Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes = 1.5.3 versions...

EUVD-2026-96525

Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...

CVE-2026-62021

The Angio theme for WordPress (versions

CVE-2026-62021 WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Angio = 1.1.1 versions...

CVE-2026-97396

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-96653

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field Second-Order in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-96563

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stmfs' parameter in all versions up to, and including, 1.4.124 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-102291

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's displayname into the composed page markup unfiltered and then running the...

CVE-2026-102774

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-104728

The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVE-2026-103478

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkoutbillingphone and state / taxid / email' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This...

CVE-2026-97340

The Avada | Website Builder For WordPress & WooCommerce theme (versions up to and including 7.16.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue resides in the Fusion_Social_Icon::get_markup() function, where social link contact-method fields (such as author_facebook) are emitt...

CVE-2026-103478

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.2.6 . The flaw stems from insufficient input sanitization and output escaping involving the checkout[billing][phone] parameter, as we...

EUVD-2026-96288

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields authorfacebook, authortwitter, authorlinkedin, authordribble, authorwhatsapp, authoremail in versions up to...

CVE-2026-103478 Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkoutbillingphone and state / taxid / email' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This...