EUVD-2026-48164

Customer Cross Site Scripting XSS in Funnel Kit Funnel Builder PRO = 3.15.0.4 versions...

EUVD-2026-48159

Unauthenticated Broken Access Control in WP Fast Total Search = 1.81.282 versions...

CVE-2026-27403

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3...

EUVD-2026-48157

Unauthenticated Broken Access Control in MarketKing = 2.1.40 versions...

CVE-2026-27403 WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3...

CVE-2026-27064 WordPress Mailster plugin <= 4.1.17 - Arbitrary File Upload vulnerability

Editor Arbitrary File Upload in Mailster = 4.1.17 versions...

CVE-2026-25427 WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability

Subscriber Broken Access Control in eRoom = 1.7.1 versions...

EUVD-2026-48146

Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...

CVE-2026-24639

The CVE-2026-24639 entry concerns the WordPress Photo Block plugin (

CVE-2026-25405

CVE-2026-25405 affects the WordPress eRoom plugin (≤ 1.7.1). It is a reported SQL Injection vulnerability. CVSSv3.1: 8.5 (HIGH), NETWORK, LOW privileges, no user interaction, confidentiality impact HIGH, integrity and availability variances (I: NONE, A: LOW), scope changed. Connected documents pr...

CVE-2026-25405 WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability

Contributor SQL Injection in eRoom = 1.7.1 versions...

CVE-2026-24628 WordPress Photo Gallery by Supsystic plugin <= 1.16.3 - Cross Site Scripting (XSS) vulnerability

Administrator Cross Site Scripting XSS in Photo Gallery by Supsystic = 1.16.3 versions...

EUVD-2025-210505

Administrator Cross Site Scripting XSS in WP-Polls = 2.77.3 versions...

WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by testoun in WordPress Plugin Popup for CF7 with Sweet Alert versions = 1.6.5...

WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Kwayy HTML Sitemap versions = 4.0...

WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Qubely versions = 1.8.14...

WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin BSK PDF Manager versions = 3.8...

CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

CVE-2026-15794 Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute

The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15827 GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints

The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are...