CVE-2026-84028

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-75793

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled...

EUVD-2026-72065

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

EUVD-2026-72063

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled...

CVE-2026-85038

CVE-2026-85038 affects the B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin for WordPress in versions before 5.2.40 . The root cause is a missing server-side verification of the role selected during self-registration: the plugin does not confirm that the submitted role is one actually offe...

CVE-2026-75793 SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled...

CVE-2026-84028 Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84028

CVE-2026-84028 affects the Bold Page Builder WordPress plugin before 5.9.9 . The root cause is an unsanitised and unescaped shortcode attribute in the Slider Elements' additional_settings , which is output directly into an HTML attribute. This allows authenticated users with the Contributor role ...

CVE-2026-84219

The Kirki WordPress plugin versions 6.2.1 through 6.2.5 are vulnerable to an unauthenticated Stored XSS caused by incomplete HTML entity decoding during rendering. An unauthenticated attacker can store JavaScript inside a comment that then executes in the session of any viewer—including an admini...

CVE-2026-84219 Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

CVE-2026-75793

The SureCart WordPress plugin versions prior to 4.7.0 fail to check the site's user registration setting before creating WordPress accounts. This allows unauthenticated users to register and receive a logged-in session even when registration is disabled on the site, effectively bypassing a common...

EUVD-2026-72064

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

EUVD-2026-72062

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-18480

The SureCart WordPress plugin before 4.6.3 contains an insufficient permission check in its customer update functionality: it fails to verify that the account being modified is the same one the check originally authorised. This allows a user with a subscriber-level account to change another user'...

CVE-2026-75816

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-18056

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...

CVE-2026-16310

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress...

CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816

The Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.12 ) is vulnerable to unauthenticated account takeover via an authentication bypass. The root cause lies in the pre_update_value function lacking a capability or ownership check, combined with ActionPost::con...

CVE-2026-18056 HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...