CVE-2026-78087

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.126.1 . The flaw exists in the Group Block 'linkToPost' feature due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-...

EUVD-2026-101848

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-101847

The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'linkurl' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-15090 Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter

The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'linkurl' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-15180 Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-18557

The Photo Gallery by 10Web WordPress plugin (versions up to and including 1.8.42 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw exists in the 'title' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web script...

EUVD-2026-101844

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-101845

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-18548 Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-101843

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-88043 Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-88043

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.0 . The root cause is insufficient input sanitization and output escaping associated with the 'data_type' parameter. This allows unauthenticated attackers to inject arbitr...

CVE-2026-17031 Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID

The Checkout Field Manager Checkout Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17031

The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 7.9.6 . The root cause is the plugin's failure to properly verify user authorization when performing specific actions. This allows authen...

CVE-2026-18586

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 7.0.5 . The root cause is insufficient input sanitization and output escaping specifically involving the 'order_email' ...

CVE-2026-18586 Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'orderemail' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

EUVD-2026-101842

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'orderemail' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-78001

The Post and Page Builder by BoldGrid (Visual Drag and Drop Editor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.27.13 . The flaw exists in the Table Designer 'data-label' Attribute due to insufficient input sanitization and output esca...

CVE-2026-86803

The Ocean Extra plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in versions up to and including 2.6.0 . The flaw exists because the software allows the execution of an action that fails to properly validate a value before calling the do_shortcode function, spec...

CVE-2026-78001 Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes ...