WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Under Construction versions = 5.82...

CVE-2026-40920

CVE-2026-40920 concerns Apache Ranger: Privilege Escalation via URL Parameter in versions

CVE-2026-12570

Removed by vendor...

CVE-2026-19284

A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was...

CVE-2026-11907

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-12801 Ultra Addons for Contact Form 7 <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Attributes

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-65576

Unauthenticated PHP Object Injection in Adrena = 1.2.14 versions...

CVE-2026-65543

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

EUVD-2026-53897

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

CVE-2026-66665

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

EUVD-2026-53879

Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...

CVE-2026-65581

Unauthenticated PHP Object Injection in AI ANN = 1.29.0 versions...

EUVD-2026-53992

Unauthenticated PHP Object Injection in Abogado = 1.18 versions...

EUVD-2026-53987

Subscriber SQL Injection in WP Job Portal = 2.5.6 versions...

EUVD-2026-53984

Shop manager Privilege Escalation in Order Delivery Date for WooCommerce = 4.6.0 versions...

CVE-2026-65542

CVE-2026-65542 concerns the WordPress WordPress Super Socializer plugin, affected versions

CVE-2025-9266

CVE-2025-9266 affects the WordPress Accelerate theme up to version 1.5.3. The root cause is a missing capability check in enqueue_scripts(), enabling authenticated users with Subscriber-level access and above to install and activate the ThemeGrill Demo Importer plugin. The impact is unauthorized ...

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...

CVE-2026-7520 MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-9273

Kadence Memberships (WordPress) up to version 4.0.0 is vulnerable to unauthenticated password-reset link poisoning due to rc_process_lost_password_form() feeding attacker-controlled rc_redirect into two unvalidated sinks in legacy/includes/forms.php (wp_redirect/esc_url and add_query_arg). The pu...