WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin <= 1.8.42 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Photo Gallery by 10Web versions = 1.8.42...

WordPress Import and export users and customers plugin <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Luca Laytynher LyT in WordPress Plugin Import and export users and customers versions = 2.4.5...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin Kirki versions = 6.2.0...

WordPress PhastPress plugin <= 3.10 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Itthidej Aramsri Boeing777 in WordPress Plugin PhastPress versions = 3.10...

CVE-2026-107870

The Crocoblock JetEngine WordPress plugin is vulnerable to a DOM-Based Cross-Site Scripting (XSS) vulnerability in versions 3.8.16 and below . The flaw is caused by improper neutralization of input during web page generation. While the specific component or file is not specified, the vulnerabilit...

WordPress Trust Payments Gateway for WooCommerce plugin < 3.1.0 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by ryan fabella in WordPress Plugin Trust Payments Gateway for WooCommerce versions 3.1.0...

WordPress Forms plugin < 3.0.2 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Forms versions 3.0.2...

WordPress affiliate-toolkit plugin < 3.9.1 - Contributor+ RCE vulnerability

Contributor+ RCE vulnerability discovered by Artus KG in WordPress Plugin affiliate-toolkit versions 3.9.1...

WordPress WPForms Lite plugin 1.10.0.1-2.0.2.1 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Abdulrhman Mari d7mr4ny in WordPress Plugin Contact Form by WPForms versions 1.10.0.1-2.0.2.1...

WordPress WPCode plugin < 2.4.0 - Unauthenticated Snippet Suppression vulnerability

Unauthenticated Snippet Suppression vulnerability discovered by Kenny of Greenhat Security in WordPress Plugin WPCode versions 2.4.0...

WordPress Fast Courier plugin 5.0.0-5.2.3 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Fast Courier versions 5.0.0-5.2.3...

WordPress Ultimate Multisite plugin < 2.17.2 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by hanzzly Farhan Auliya Abrar in WordPress Plugin Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform versions 2.17.2...

WordPress CamPay Shortcode Payment Gateway plugin < 1.7 - Unauthenticated Payment Status Forgery vulnerability

Unauthenticated Payment Status Forgery vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin CamPay Shortcode Payment Gateway versions 1.7...

CVE-2026-97278 WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9...

CVE-2026-97278

The WP SYNTEX Polylang plugin (versions up to and including 3.8.9 ) is vulnerable to a PHP Object Injection flaw caused by the deserialization of untrusted data in the polylang component. This vulnerability allows for high-impact consequences regarding confidentiality, integrity, and availability...

CVE-2026-97315

The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that ema...

CVE-2026-88998

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount, allowing unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without...

CVE-2026-82844

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway, allowing unauthenticated visitors to submit paid forms without paying. The form's confirmation is delivered and its...

CVE-2026-101301

The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing unauthenticated visitors to disable all of the site's automatically inserted snippets for their own requests...

WordPress Meow Lightbox plugin <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Meow Lightbox versions = 5.6.2...