WordPress Bold Page Builder plugin < 5.9.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Md. Minaruzzaman Shovon in WordPress Plugin Bold Page Builder versions 5.9.8...

CVE-2026-84022 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

EUVD-2026-71852

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

EUVD-2026-71851

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site...

EUVD-2026-71850

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

EUVD-2026-71848

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token they can obtain, or to create and log into a new...

CVE-2026-78150 Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR

The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata...

WordPress Smart Post plugin 4.0.0-4.0.7 - Contributor+ Private and Protected Post Content Disclosure vulnerability

Contributor+ Private and Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

WordPress Search Atlas SEO plugin < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion vulnerability

Subscriber+ Google Service Account Credential Overwrite/Deletion vulnerability discovered by Shivamani Vastrala in WordPress Plugin Search Atlas SEO versions 2.6.24...

EUVD-2026-71846

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...

CVE-2026-15247 Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

CVE-2026-15247

CVE-2026-15247 affects the Search Atlas SEO WordPress plugin in versions prior to 2.6.24 . The root cause is a missing nonce or capability check before processing a settings update in one of the plugin's early-priority handlers. This allows any authenticated user at the Subscriber level or above ...

WordPress JCH Optimize plugin 4.2.1-5.0.0 - Admin+ Path Traversal vulnerability

Admin+ Path Traversal vulnerability discovered by Krugov Artyom in WordPress Plugin JCH Optimize versions 4.2.1-5.0.0...

CVE-2026-18404

CVE-2026-18404 affects the Social Chat – Click To Chat App Button (WP WhatsApp Chat) WordPress plugin, versions up to and including 8.6.2 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping of the consent_message JSON attribute ...

EUVD-2026-71843

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-8625 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

EUVD-2026-71841

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

CVE-2026-83628 Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2026-8625 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...