PT-2026-84715

The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API...

PT-2026-84700

Unauthenticated Cross Site Request Forgery CSRF in Mang Board WP = 2.3.8 versions...

PT-2026-84683

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

CVE-2026-81283: Deserialization of Untrusted Data

Subscriber PHP Object Injection in WP User Frontend = 4.3.10 versions...

PT-2026-84694

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...

WordPressMassExploiter

WordPressMassExploiter Mass exploiter of CVE-2015-1579 for WordPress CMS This mass exploiter is based on CVE-2015-1579, discovered by CLAUDIO VIVIANI https://www.exploit-db.com/exploits/36554/ How it works: 1 - I use Selenium Framework to make the search on google. 2 - The results of search, are...

5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin

On August 14th, 2026, we received a submission for an Unauthenticated Second-Order SQL Injection vulnerability in All-in-One WP Migration and Backup, a WordPress plugin with more than 5 million active installations. This vulnerability makes it possible for unauthenticated attackers to inject SQL...

WordPress WP File Download plugin <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Deletion via 'remoteurl' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin WP File Download versions = 6.3.4...

CVE-2026-7877

The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-7877 WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode

The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-7877 WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode

The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

EUVD-2026-69093

The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-7877

WP Recipe Maker Premium for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in the wprm-call-to-action shortcode, affecting all versions up to and including 10.5.0 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes. Attackers with cont...

CVE-2026-78363

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

CVE-2026-74916

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

WordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by 20kilograma in WordPress Plugin WP Event SOlution versions = 4.1.22...

WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin WP User Frontend versions = 4.3.10...

CVE-2026-78363 MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

CVE-2026-78363 MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

EUVD-2026-68991

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...