CVE-2026-61964

Unauthenticated Cross Site Scripting XSS in Ninja Tables = 5.2.9 versions...

CVE-2026-61982 WordPress SiteGuard WP Plugin plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...

EUVD-2026-53958

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-61961

CVE-2026-61961 concerns the WordPress plugin EmbedPress (versions

CVE-2026-61959 WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

EUVD-2026-53952

Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...

CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

EUVD-2026-53942

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-28111

CVE-2026-28111 affects the WordPress Forminator plugin up to version 1.56.0. The vulnerability is a contributor privilege escalation, with CVSSv3.1 metrics indicating high impact (C/H, I/H, A/H) and network attack vector with low complexity and low privileges required. Connected sources confirm t...

EUVD-2026-53941

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

EUVD-2026-53940

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

EUVD-2026-53938

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

EUVD-2026-53939

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer = 1.5.19 versions...

EUVD-2026-53937

Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin GeekyBot versions = 1.2.6...

WordPress Agricola theme <= 1.21.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds in WordPress Theme Agricola versions = 1.21.0...

WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by johska in WordPress Theme Abelle versions = 1.22...

CVE-2025-15028

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This...

CVE-2025-9266

CVE-2025-9266 affects the WordPress Accelerate theme up to version 1.5.3. The root cause is a missing capability check in enqueue_scripts(), enabling authenticated users with Subscriber-level access and above to install and activate the ThemeGrill Demo Importer plugin. The impact is unauthorized ...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...