EUVD-2026-89843

Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...

CVE-2026-94178 WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...

CVE-2026-62083 WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability

Subscriber Other Vulnerability Type in Creator LMS = 1.2.19 versions...

CVE-2026-92712

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-93908

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforepricetext' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-92712 ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-92712

The ReactPress WordPress plugin (versions up to and including 3.4.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the permalink parameter. The root cause is insufficient input sanitization and output escaping; the application uses sanitize_url(), which fails to prevent the fetching of ...

CVE-2026-92712 ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

EUVD-2026-89685

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-93908

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.3 . The flaw exists in the 'before_price_text' parameter due to insufficient input sanitization and output escaping. Specif...

CVE-2026-93908 Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforepricetext' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-93908 Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'beforepricetext' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress ReactPress – Create React App for WordPress plugin <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Nabil Irawan in WordPress Plugin ReactPress versions = 3.4.0...

WordPress Real Estate Manager – Property Listing and Agent Management plugin <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Real Estate Manager versions = 7.3...

WordPress Simply Schedule Appointments plugin <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion vulnerability

Authenticated Subscriber+ Local File Inclusion vulnerability discovered by crow in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.27...

CVE-2026-89294

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 1.6.12.27 . The root cause is the 'ssa_locale' parameter, which processes raw GET values without nonce or capability checks during the plugins_loaded action. While...

EUVD-2026-89654

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...

CVE-2026-89190

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...

CVE-2026-90953 Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...

CVE-2026-89190 Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages an...