616166 matches found
CVE-2026-84934
CVE-2026-84934 affects the JCH Optimize WordPress plugin before 6.0.1 . The root cause is a missing capability check on an authenticated AJAX action that allows the request to select which internal action runs (specifically a getcacheinfo task override). This lets any authenticated user, includin...
CVE-2026-84927 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...
WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability
Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.22...
WordPress VikWidgetsLoader plugin < 1.12.0 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin VikWidgetsLoader versions 1.12.0...
EUVD-2026-71868
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...
CVE-2026-84926
The EmbedPress WordPress plugin (versions 4.6.0–4.6.3 ) contains an insufficient access control flaw in one of its Google Reviews REST routes , which should be restricted to administrators but is accessible to any authenticated user with contributor-level privileges or above . This allows such us...
CVE-2026-84901
The Eventin WordPress plugin (a.k.a. WP Event Solution) versions before 4.1.22 lack proper authorization checks on several event-management REST routes. Users with contributor-level access or above can change the site's front-page setting to an event they do not own and create, edit, or delete gl...
WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Google Reviews Modification vulnerability
Contributor+ Google Reviews Modification vulnerability discovered by Artus KG in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...
WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Administrator Email Disclosure vulnerability
Contributor+ Administrator Email Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...
CVE-2026-84926 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...
EUVD-2026-71870
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...
EUVD-2026-71869
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...
CVE-2026-84745 The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
WordPress The Events Calendar plugin < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability
Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.17.3.1...
CVE-2026-84896 King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...
CVE-2026-84896 King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...
EUVD-2026-71862
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
EUVD-2026-71864
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...