CVE-2026-78363

The MW WP Form WordPress plugin versions before 5.1.5 fail to sanitize shortcodes in user-submitted values before merging them into a completion message that is later processed for shortcodes. This allows unauthenticated users to execute any shortcode registered on the site by submitting crafted ...

WordPress MW WP Form plugin < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin MW WP Form versions 5.1.5...

CVE-2026-74916

WP Fastest Cache WordPress plugin (versions 0.8.7.7 through 1.5.0 ) is vulnerable to unauthenticated cache poisoning via unkeyed tracking parameters. The plugin does not include certain tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing...

WordPress WP Fastest Cache plugin 0.8.7.7-1.5.0 - Unauthenticated Cache Poisoning vulnerability

Unauthenticated Cache Poisoning vulnerability discovered by Amity Gilmour in WordPress Plugin WP Fastest Cache versions 0.8.7.7-1.5.0...

EUVD-2026-68990

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

CVE-2026-74916 WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

CVE-2026-74916 WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

WordPress WP Recipe Maker Premium plugin <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode vulnerability discovered by theviper17y in WordPress Plugin WP Recipe Maker Premium versions = 10.5.0...

PT-2026-84123

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

PT-2026-84124

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

CVE-2026-7877: Improper Neutralization of Input During Web Page Generation

The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-74916: Acceptance of Extraneous Untrusted Data With Trusted Data

The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served...

CVE-2026-78363: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...

PT-2026-84169

The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-81293

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-81293 WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

EUVD-2026-68780

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-81293 WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Data Access = 5.5.81 versions...

CVE-2026-81293

CVE-2026-81293 is an unauthenticated SQL injection vulnerability in the WP Data Access WordPress plugin, affecting versions 5.5.81 and below . The flaw was discovered by sequence_X0 and reported via Patchstack. The CVSS v3.1 score is 9.3 (Critical) , with a network attack vector, low complexity, ...

WordPress Shopping Cart & eCommerce Store plugin <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'productorder' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP EasyCart versions = 5.9.2...