CVE-2026-15281

The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wpajaxsave-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId value stored in the saveAjaxAttachmentDa...

CVE-2026-17505 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

CVE-2026-17532 Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

CVE-2026-17532

Summary: CVE-2026-17532 affects the Seraphinite Accelerator WordPress plugin (≤ 2.29.15). It allows unauthenticated users to perform a reflected XSS via the seraph_accel_prep parameter. Root cause per the CVE description: a loose PHP comparison in CacheExtractPreparePageParams() (using != against...

CVE-2026-17532

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

EUVD-2026-53175

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

CVE-2026-17532 Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

MAL-2026-12097 Malicious code in @wethenorth12/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c373b3f6b1c60d079fb7c63d13a51f7e42ee41feeff2c04c5ab925ad5dad41fb Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions createWallet, generateMnemonic to attract...

Malicious code in @wethenorth12/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c373b3f6b1c60d079fb7c63d13a51f7e42ee41feeff2c04c5ab925ad5dad41fb Package advertises itself as a drop-in replacement for bip39 and exposes stub wallet functions createWallet, generateMnemonic to attract...

Malicious code in @ccfly/setup-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d5a88a77e76664c9050d9bad333214c053469264fff83ba56e2a68eaecfdfaa The tarball ships a single 6.4 MB Go binary at bin/ccfly-setup for darwin/arm64. The binary links github.com/gorilla/websocket and...

MAL-2026-12084 Malicious code in @ccfly/setup-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d5a88a77e76664c9050d9bad333214c053469264fff83ba56e2a68eaecfdfaa The tarball ships a single 6.4 MB Go binary at bin/ccfly-setup for darwin/arm64. The binary links github.com/gorilla/websocket and...

CVE-2026-8761

The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the CustomersController REST controller includes/REST/CustomersController.php, which re-registers WooCommerce's customer CRUD routes...

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

CVE-2026-9273

The Membership Plugin – Kadence Memberships plugin for WordPress formerly Restrict Content is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rcprocesslostpasswordform consuming th...

CVE-2026-5062

The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' search parameter on the Pretty Links listing page in all versions up to, and including, 3.6.20. This is due to insufficient escapin...

CVE-2026-15941

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

CVE-2026-11421

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-15360 Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database...

CVE-2026-15360

CVE-2026-15360 affects the Ajax Load More WordPress plugin prior to 8.0.1. The root cause is improper sanitization/escaping of a parameter used in a SQL query, enabling unauthenticated, time-based blind SQL injection to extract data. Affected component: parameter handling in the plugin’s SQL cons...

EUVD-2026-53118

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database...