CVE-2026-17586

The VK All in One Expansion Unit WordPress plugin (versions up to and including 9.118.0 ) is vulnerable to Stored Cross-Site Scripting via the vkExUnit_cta_img_position post meta field. The root cause is insufficient input sanitization and output escaping: the sanitize_text_field callback on save...

CVE-2026-17586 VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-84903

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and...

CVE-2026-88994

The All Bootstrap Blocks WordPress plugin (versions 1.3.20 through 1.3.31 ) contains a Local File Inclusion (LFI) vulnerability in its Lightspeed subsystem. A block attribute is used to build a filesystem path that is included at render time without validation, allowing users with contributor-lev...

EUVD-2026-82687

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

EUVD-2026-82661

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...

EUVD-2026-82643

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-82607

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-74000

CVE-2026-74000 affects the WordPress Simple Membership plugin in versions ≤ 4.8.2 . The vulnerability is a Broken Access Control flaw discovered by Ananda Dhakal (Patchstack). The CVSS 3.1 score is 5.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N , indicating a network-exploitable...

EUVD-2026-81498

Contributor Cross Site Scripting XSS in JetSearch = 3.6.3 versions...

EUVD-2026-81497

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

CVE-2026-66576

CVE-2026-66576 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the JetBlocks For Elementor WordPress plugin, affecting versions 1.5.2 and earlier . The flaw was discovered by nh4tvd (reported via Patchstack). The vulnerability carries a CVSS 3.1 base score of 6.5 (MEDIUM) with ...

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-15609

The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circleline' Shortcode Attribute in all versions up to, and including, 30.8.9.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-91870

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn shedule objective' schedule slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output...

WordPress Eventin plugin <= 4.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Event Solution versions = 4.1.23...

WordPress WP Highlight Box plugin <= 1.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Pablo González and Francisco José Ramírez in WordPress Plugin WP Highlight Box versions = 1.0...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection in the task synthesis, which interpolates configuration properties and auto-discovered file names into the generated .projen/tasks.json without escaping shell metacharacters, affecting properties including extraArgs,...