CVE-2026-16603

The Passster WordPress plugin is affected by CVE-2026-16603: versions prior to 4.3.6 do not enforce category-based content protection on the WordPress REST API, allowing unauthenticated users to read full content, title, and excerpt of category-locked posts via the core REST API. This is an unaut...

CVE-2026-4804

The Zakra WordPress theme (

CVE-2026-6127

The Elementor Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the elementordata meta field in versions up to, and including, 4.0.4. This is due to insufficient input sanitization when processing form-encoded REST API requests. The plugin registers the...

WordPress Interface theme <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Interface versions = 3.1.0...

WordPress Interface Theme <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Interface Type Theme Vulnerable versions = 3.1.0 Fixed in 3.1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35758 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9257c03a0537 Credits stealthcopter Required privilege Contributor...