CVE-2026-97339 Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-102615

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the algwcevverifyemail parameter in versions up to, and including, 3.3.0. The vulnerability exists because algwcevgenerateusercode generates the per-user activation secret using wprand10...

EUVD-2026-102616

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

CVE-2026-104769

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.3.0 . The flaw exists in the 's' parameter and allows an unauthenticated visitor to read arbitrary files on the server, potentially exposing sensitive infor...

CVE-2026-104745 Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the algwcevverifyemail parameter in versions up to, and including, 3.3.0. The vulnerability exists because algwcevgenerateusercode generates the per-user activation secret using wprand10...

CVE-2026-104769 Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

EUVD-2026-102614

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104745

The Customer Email Verification for WooCommerce plugin for WordPress (versions

CVE-2026-97339

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.5.5 . The root cause is insufficient input sanitization and output escaping within the yotu-wp Cookie-Blocker Filter . An unauthenticated att...

CVE-2026-93953 Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...

EUVD-2026-102611

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-103518

The FluentCart WordPress plugin (versions up to and including 1.7.0 ) is vulnerable to a generic SQL Injection flaw. The root cause is insufficient escaping of user-supplied parameters and a lack of sufficient preparation on existing SQL queries involving the 'products[*].variants[*].' parameter....

CVE-2026-103518 FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-109990 Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-102612

The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-102613

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...

CVE-2026-109990

The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.2.4 . The root cause is insufficient input sanitization and output escaping within the 'comment' parameter. Attackers ...

CVE-2026-93953

The Backuply WordPress plugin (versions

CVE-2026-77829 Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-93535 WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute

The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iconlight' Shortcode Attribute in all versions up to, and including, 5.3.17 due to insufficient input sanitization and output escaping. This makes it possibl...