CVE-2024-54379

CVE-2024-54379 Minterpress = 1.0.5 - Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update Description The Minterpress plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on a functio...

CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2026-118169

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-118169

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.8.14.3 . The flaw exists because of insufficient input sanitization and output escaping of the 'content[cta_label]' parameter...

CVE-2026-118169 Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-111613

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'contentctalabel' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-111960

The Royal MCP WordPress plugin before version 1.5.10 contains a vulnerability where it fails to perform proper object-level or post-type authorisation checks within one of its search tools. This flaw allows authenticated users, such as those with subscriber privileges, to disclose the titles and ...

CVE-2026-111960 Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal M...

CVE-2026-111727

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vstextsubmitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-111727

The Appointment Booking Calendar plugin for WordPress (versions up to and including 1.4.05 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the 'vs_text_submitbtn' parameter. Authenticated attackers with Subscriber-lev...

CVE-2026-111727 Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vstextsubmitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-111577

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vstextsubmitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-109209

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...

CVE-2026-107745

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

CVE-2026-107625

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userurl' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and...

CVE-2026-109209

The All-in-One Video Gallery WordPress plugin (versions up to and including 4.9.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the custom_fields[embedcode] parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Subscriber ...

CVE-2026-109209 All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...

EUVD-2026-111564

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customfieldsembedcode' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output...

EUVD-2026-111565

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

CVE-2026-107745

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion in versions up to and including 3.8.4 . The root cause is insufficient file path validation in the upload_file function, which allows authenticated attackers with subscr...