92692 matches found
CVE-2026-84931
CVE-2026-84931 affects the Joli Table Of Contents WordPress plugin in versions prior to 3.0.3 . The root cause is a missing sanitisation/escape of a shortcode attribute value before output inside an HTML element's attribute, enabling a stored XSS . Users with the Author role or higher can inject ...
WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Google Reviews Modification vulnerability
Contributor+ Google Reviews Modification vulnerability discovered by Artus KG in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...
WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Administrator Email Disclosure vulnerability
Contributor+ Administrator Email Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...
WordPress CatFolders Document Gallery & PDF Library plugin < 2.0.7 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin CatFolders Document Gallery & PDF Library versions 2.0.7...
EUVD-2026-71872
The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...
CVE-2026-84927
The EmbedPress WordPress plugin (versions 4.6.0–4.6.3 ) contains an insufficient authorization check on a Google Reviews REST API route . Users with the Contributor role or higher can modify the site-wide store, deleting entries configured by an administrator and injecting their own , which are r...
CVE-2026-84896 King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...
CVE-2026-84745 The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
CVE-2026-84896 King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...
CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
WordPress King Addons for Elementor plugin < 51.1.77 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin King Addons for Elementor versions 51.1.77...
WordPress The Events Calendar plugin < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability
Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.17.3.1...
WordPress Kirki plugin 6.0.0-6.2.5 - Editor+ SQLi vulnerability
Editor+ SQLi vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Kirki versions 6.0.0-6.2.5...
CVE-2026-84225
The Kirki WordPress plugin (versions 6.0.0–6.2.5 ) contains an authenticated IDOR flaw in its collaboration comment handling. The plugin fails to verify that a user is authorized to act on a specific collaboration comment before changing its state, allowing users with content-level page-builder a...
EUVD-2026-71864
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
CVE-2026-84221
The Kirki WordPress plugin (versions 6.0.0–6.2.5 ) contains a SQL injection vulnerability in the Content Manager Field ID parameter. A user-supplied identifier is not escaped before being used in a SQL query, allowing authenticated users with editor-level privileges or higher to append arbitrary ...
CVE-2026-84745
The The Events Calendar WordPress plugin (versions before 6.17.3.1 ) fails to restrict non-public content in its public REST archives, allowing users with a contributor or higher role to read the full contents of every unpublished event, venue, and organizer record on the site, including those be...
CVE-2026-84898
The Eventin WordPress plugin (WP Event Solution) versions prior to 4.1.21 contain a Local File Inclusion (LFI) vulnerability via the Event Layout Meta feature. The plugin fails to properly validate a template path value before including a local file, allowing users with contributor-level access o...