EUVD-2026-69834

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

EUVD-2026-69833

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

CVE-2026-77764

GamiPress WordPress plugin versions before 7.9.9.6 do not properly restrict its video watch-tracking functionality (specifically the Watch-Video Listeners). This allows users with a role as low as Subscriber to award configured gamification points, achievements, and ranks to arbitrary users—inclu...

EUVD-2026-69836

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...

EUVD-2026-69835

The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated users to retrieve vendor contact and payout details, pending payout amounts, and administrative notes attached to store applications...

CVE-2026-19723

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is improper escaping of a value taken from an incoming request before it is output in an inline JavaScript event handler. Per the CVELIST reco...

CVE-2026-16983

CVE-2026-16983 affects the Gutentor WordPress plugin in versions prior to 4.0.6 . The plugin fails to apply the correct context restriction to one of its REST API endpoints , which exposes the plaintext passwords of password-protected posts. The exposure is available to any authenticated user hol...

EUVD-2026-69866

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

EUVD-2026-69864

The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...

CVE-2026-19453

JetBackup for WordPress (versions 3.1.7.9 through 3.1.23.3 ) contains a privilege escalation vulnerability. The plugin fails to verify the role or capabilities of the user account it preserves across a restore or migration operation before granting it administrator privileges . This allows a subs...

CVE-2026-19251

The Ultimate Member WordPress plugin (before 2.13.0 ) fails to verify whether a comment has been approved or whether the profile it belongs to is private before returning profile activity data to unauthenticated visitors . This allows anyone without an account to read the content of comments stil...

EUVD-2026-69863

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates th...

EUVD-2026-69865

The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform PHP Object Injection, which may lead ...

CVE-2026-14215

The Booking for Appointments and Events Calendar WordPress plugin (also referred to as Amelia ) is vulnerable to unauthenticated post-booking action triggering in versions before 2.4.9 . The root cause is the absence of an authentication check or valid request token before executing the post-book...

CVE-2026-16966

The Solace Extra WordPress plugin (before 1.7.0 ) fails to perform authorization or post-status checks in its get_elementor_content AJAX action. This allows unauthenticated visitors to read the content of non-published Site Builder parts (draft, pending, private, and trashed) that WordPress would...

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 is vulnerable to a stored XSS via the slider's before-label value. The plugin does not properly escape this value before its bundled client-side script re-injects it into the DOM. An attacker with the Author role or h...

EUVD-2026-69869

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the post-booking action chain, allowing an unauthenticated user to trigger booking notifications and integration callbacks for a booking by...

EUVD-2026-69870

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

EUVD-2026-69868

The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking identifier on an unauthenticated endpoint, allowing unauthenticated attackers to permanently delete other users' reservations. This is an...

EUVD-2025-210822

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...