616573 matches found
EUVD-2026-71870
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...
EUVD-2026-71869
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...
WordPress The Events Calendar plugin < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability
Contributor+ Non-Public Event, Venue and Organizer Content Disclosure vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.17.3.1...
CVE-2026-84745 The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
CVE-2026-84896 King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...
CVE-2026-84896 King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...
CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
EUVD-2026-71862
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
EUVD-2026-71864
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
CVE-2026-84898 Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
CVE-2026-84221
The Kirki WordPress plugin (versions 6.0.0–6.2.5 ) contains a SQL injection vulnerability in the Content Manager Field ID parameter. A user-supplied identifier is not escaped before being used in a SQL query, allowing authenticated users with editor-level privileges or higher to append arbitrary ...
CVE-2026-84898
The Eventin WordPress plugin (WP Event Solution) versions prior to 4.1.21 contain a Local File Inclusion (LFI) vulnerability via the Event Layout Meta feature. The plugin fails to properly validate a template path value before including a local file, allowing users with contributor-level access o...
CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
CVE-2026-84745
The The Events Calendar WordPress plugin (versions before 6.17.3.1 ) fails to restrict non-public content in its public REST archives, allowing users with a contributor or higher role to read the full contents of every unpublished event, venue, and organizer record on the site, including those be...
CVE-2026-84225 Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cann...
EUVD-2026-71863
The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom an administrator has granted content-level access to the page builder to modify comments left by other users, including on pages they cann...
EUVD-2026-71866
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
EUVD-2026-71865
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...
CVE-2026-84896
King Addons for Elementor WordPress plugin versions before 51.1.77 suffer from a Contributor+ Stored XSS vulnerability in the Magazine Grid Widget . A widget display-style setting is not properly escaped before being output in an HTML attribute, allowing users with Contributor-level access or hig...
WordPress Bold Page Builder plugin < 5.9.8 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Bold Page Builder versions 5.9.8...