CVE-2026-104724

The FireBox – WooCommerce Popup Builder plugin for WordPress is vulnerable to a generic SQL Injection in all versions up to and including 3.1.13 . The root cause is insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries within the FireBox Fo...

EUVD-2026-96066

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

CVE-2026-48908

CVE-2026-48908 — SP Page Builder Joomla Unauthenticated RCE Proof-of-concept exploit for CVE-2026-48908 , a critical CVSS 4.0 = 10.0 unauthenticated remote-code-execution vulnerability in the SP Page Builder component comsppagebuilder for Joomla, by JoomShaper. | ---|--- CVE| CVE-2026-48908...

EUVD-2026-96027

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo...

CVE-2026-14882: Improper Neutralization of Input During Web Page Generation

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-100147: Improper Neutralization of Input During Web Page Generation

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shippingfirstname' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-97670: Improper Control of Generation of Code

The Avada Fusion Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field valu...

CVE-2026-97340: Improper Neutralization of Input During Web Page Generation

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields authorfacebook, authortwitter, authorlinkedin, authordribble, authorwhatsapp, authoremail in versions up to...

PT-2026-109496

Name of the Vulnerable Software and Affected Versions Avada versions prior to 7.16.2 Fusion Builder versions prior to 3.16.2 Description An authorization bypass exists due to improper verification before dispatching a WordPress action hook. The issue occurs when the hook name is derived from an...

CVE-2026-104724: Improper Neutralization of Special Elements used in an SQL Command

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to, and including, 3.1.13 due to insufficient escaping on the user supplied parameter and la...

PT-2026-109595

Name of the Vulnerable Software and Affected Versions WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More versions prior to 2.0.2.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

CVE-2026-101921: Improper Neutralization of Input During Web Page Generation

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-3717: Missing Authorization

The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wpsavesignatureimage' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to...

CVE-2026-104762: Improper Neutralization of Input During Web Page Generation

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Block Font Family Attribute in all versions up to, and including, 3.7.12 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-104915: Missing Authorization

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to XML Injection.

Summary fast-xml-builder is used by IBM Storage Fusion Data Foundation, which could cause XML Injection. CVE-2026-44665. Vulnerability Details CVEID:CVE-2026-44665 DESCRIPTION: fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process...

WordPress FunnelKit – Funnel Builder for WooCommerce Checkout plugin <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Funnel Builder by FunnelKit versions = 3.16.0.5...

WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 2.0.2.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Contact Form by WPForms versions = 2.0.2.1...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Zenith-sec in WordPress Plugin JetFormBuilder versions = 3.6.6...

WordPress Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.12...