CVE-2026-13439

The CVE-2026-13439 entry affects the WordPress plugin Easy Form Builder by WhiteStudio up to version 4.0.11 , where the password-recovery flow relies on a publicly visible session identifier ('sid') as the reset token stored in wp_emsfb_temp_links, combined with a publicly accessible nonce refres...

CVE-2026-13439 Easy Form Builder by WhiteStudio <= 4.0.11 - Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint

The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier 'sid' as the password reset token store...

CVE-2026-15782 WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to...

CVE-2026-15782

CVE-2026-15782 describes a stored XSS in WPForms – AI Form Builder for WordPress (WordPress plugin) up to version 2.0.0.1, caused by insufficient input sanitization and output escaping. The vulnerability affects pages containing content with OptinMonster integration data-sitekey attributes, and c...

EUVD-2026-46149

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This mak...

EUVD-2026-46114

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-61846

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible...

📄 WordPress Category Ajax Filter 2.8.2 Unauthenticated Local File Inclusion / Code Execution

WordPress Category Ajax Filter plugin version 2.8.2 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is already...

📄 WordPress WP Directory Kit 1.4.3 Unauthenticated Blind SQL Injection

WordPress WP Directory Kit plugin version 1.4.3 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...

📄 WordPress Enable SVG, WebP and ICO Upload 1.1.2 Shell Upload

WordPress Enable SVG, WebP and ICO Upload plugin version 1.1.2 contains an authenticated Author+ arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

📄 WordPress Ajax Filter Posts (GridMaster) 3.4.11 Unauthenticated Local File Inclusion / Code Execution

WordPress Ajax Filter Posts GridMaster plugin version 3.4.11 contains an unauthenticated local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

📄 WordPress Community Events 1.5.1 Unauthenticated Blind SQL Injection

WordPress Community Events plugin version 1.5.1 contains an unauthenticated time-based blind SQL injection vulnerability. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit demonstrates the vulnerabl...

📄 WordPress LearnPress 4.2.6.8.1 LFI / Remote Code Execution

WordPress LearnPress plugin version 4.2.6.8.1 contains an authenticated Contributor+ local file inclusion to remote code execution vulnerability. A remote attacker can traverse the filesystem and include attacker-controlled PHP code, resulting in remote code execution when a suitable file is...

CVE-2026-12900

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-8825

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, privat...

CVE-2026-12970

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

CVE-2026-12898

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory...

CVE-2026-13142

The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a working attempt lockout on its passwordless email one-time-password verification, and stores the short numeric codes in plaintext, allowing an unauthenticated attacker who knows a...

CVE-2026-13156

The MailerSend WordPress plugin before 1.0.8 does not perform a nonce check on its configuration-delete action it verifies the manageoptions capability but ignores the nonce, so an attacker can trick a logged-in administrator into visiting a crafted page that wipes the MailerSend WordPress plugin...