WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by whale120 in WordPress Plugin Profile Builder versions = 4.0.3...

CVE-2026-105882 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8...

CVE-2026-109692

The ThemeGrill User Registration WordPress plugin, versions

WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pr0f in WordPress Plugin User Registration versions = 5.2.8...

WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Anatoly Gorbounov x1will in WordPress Plugin User Registration versions = 5.2.8...

WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by nov1337 in WordPress Plugin User Registration versions = 5.2.8...

CVE-2026-106598

The ThemeGrill User Registration WordPress plugin (versions n/a through 5.2.8 ) is vulnerable to a Missing Authorization vulnerability. This flaw allows an attacker to Retrieve Embedded Sensitive Data . No specific technical root cause, exploit details, or remediation steps are provided in the do...

WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by sumayfe in WordPress Plugin User Registration versions = 5.2.8...

WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pr0f in WordPress Plugin User Registration versions = 5.2.8...

CVE-2026-106597

The ThemeGrill User Registration plugin for WordPress (versions up to and including 5.2.8 ) contains a Broken Access Control vulnerability. The root cause is Missing Authorization resulting from incorrectly configured access control security levels. This vulnerability allows for the exploitation ...

WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by b1ue0cean in WordPress Plugin User Registration versions = 5.2.8...

WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Charles Vosburgh in WordPress Plugin User Registration versions = 5.2.8...

WordPress User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin WP User Frontend versions = 4.3.12...

CVE-2026-96334 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7...

WordPress User Private Files plugin < 2.1.9 - Subscriber+ User Email Address Disclosure vulnerability

Subscriber+ User Email Address Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin User Private Files versions 2.1.9...

WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin User Submitted Posts versions = 20260810...

WordPress User Frontend plugin < 4.3.10 - Editor+ PHP Object Injection vulnerability

Editor+ PHP Object Injection vulnerability discovered by Hijun Kim in WordPress Plugin WP User Frontend versions 4.3.10...

PT-2026-67943

Name of the Vulnerable Software and Affected Versions VikAppointments Service Booking Calendar affected versions not specified Description An unauthenticated SQL injection exists because a parameter controlling the sorting of the public reviews list is used to construct a database query without...

CVE-2026-8457 WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

WordPress User Frontend plugin < 4.3.8 - Unauthenticated Author-less Attachment Deletion vulnerability

Unauthenticated Author-less Attachment Deletion vulnerability discovered by kimsunghoon in WordPress Plugin WP User Frontend versions 4.3.8...