EUVD-2026-53958

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-61959 WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-61961

CVE-2026-61961 concerns the WordPress plugin EmbedPress (versions

EUVD-2026-53952

Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...

EUVD-2026-53941

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2026-28111

CVE-2026-28111 affects the WordPress Forminator plugin up to version 1.56.0. The vulnerability is a contributor privilege escalation, with CVSSv3.1 metrics indicating high impact (C/H, I/H, A/H) and network attack vector with low complexity and low privileges required. Connected sources confirm t...

EUVD-2026-53942

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

EUVD-2026-53940

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

EUVD-2026-53939

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer = 1.5.19 versions...

EUVD-2026-53938

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

EUVD-2026-53937

Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin GeekyBot versions = 1.2.6...

CVE-2026-66066-POC — Updated!

PoC for CVE-2026-66066 - Minimal stock Rails/libvips lab This repository reproduces the Rails Active Storage file-read-to-RCE chain described by GHSA-xr9x-r78c-5hrm against Rails 8.1.3, the newest affected Rails 8.1 release. Rails 8.1.3.1 is the patched control. Use it only in the disposable loca...

CVE-2026-19041 MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...

EUVD-2026-53927

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...

EUVD-2026-53924

A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to...

WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agricola versions = 1.21.0...

WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Abelle versions = 1.22...

CVE-2025-15028

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This...