CVE-2026-66616 WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Form Maker by 10Web = 1.15.46 versions...

EUVD-2026-63343

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

CVE-2026-66601

Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...

CVE-2026-66595 WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

CVE-2026-66595

The WordPress WP Data Access plugin (versions ≤ 5.5.80) has an unauthenticated broken access control flaw allowing remote, no-auth access to restricted functionality with HIGH confidentiality impact (CVSS 5.9). No patch version or exploitation details are provided; monitor Patchstack's advisory f...

EUVD-2026-63338

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

CVE-2026-66593

Unauthenticated SQL Injection in Security & Malware scan by CleanTalk = 2.184 versions...

CVE-2026-66592 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...

CVE-2026-66583 WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...

CVE-2025-53999 WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

CVE-2025-53999

The WordPress Altair theme (versions up to 5.2.2) has an unauthenticated broken access control flaw (CVSS 6.5, medium), exploitable remotely without credentials. An attacker can alter or disrupt functionality (low integrity/availability impact) but cannot read sensitive data. No fix version or ex...

EUVD-2025-210757

Unauthenticated Broken Access Control in Altair = 5.2.2 versions...

CVE-2025-15688 WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

Unauthenticated SQL Injection in Capella = 2.5.5 versions...

EUVD-2025-210756

Unauthenticated Privilege Escalation in Capella = 2.5.5 versions...

CVE-2025-15689

The WordPress Capella theme (≤2.5.5) allows unauthenticated remote privilege escalation with no user interaction, rated CVSS 9.8 critical. No root cause, patch version, or exploit details are provided in the documents; see the Patchstack advisory for further information. Exploitation status is no...

EUVD-2026-63328

Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...

CVE-2026-74021

WordPress Chaplin theme ≤2.6.8 has an unauthenticated broken access control flaw, allowing remote attackers to access restricted content (CVSS 7.5 HIGH, network/low-complexity, no auth). No patch version or exploit details are provided; update to a newer theme version when available.

CVE-2026-74021 WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Chaplin = 2.6.8 versions...

CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...

CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool

n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances with N8NSSRFPROTECTIONENABLED=true, an...