1378 matches found
EUVD-2026-64216
The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...
WordPress EWWW Image Optimizer plugin <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content vulnerability discovered by UKO - Korea univ. in WordPress Plugin EWWW Image Optimizer versions = 8.7.3...
WordPress YMC Filter plugin < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema vulnerability
Contributor+ Stored XSS via Layout Builder Schema vulnerability discovered by Usama Arshad in WordPress Plugin Filter & Grids versions 3.12.8...
WordPress Slick Slider plugin < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode vulnerability
Contributor+ Stored XSS via Gallery Shortcode vulnerability discovered by testoun in WordPress Plugin Slick Slider versions 0.5.3...
WordPress Classified Listing plugin < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts vulnerability
Contributor+ Unpublished Post Content Disclosure via rtclblockcssgetposts vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Classified Listing versions 5.4.4...
CVE-2026-19699
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account...
CVE-2026-19699
The GutenKit WordPress plugin (versions 2.4.12–2.4.15 , before 2.5.0) contains an insufficient capability check on certain REST API endpoints . This allows authenticated users with the Contributor role or higher to retrieve mailing-list audience metadata from the site's connected Mailchimp market...
CVE-2026-19699 GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account...
CVE-2026-68565
Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...
CVE-2026-66627
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-74006 WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability
Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...
CVE-2026-74006
The WordPress plugin WP Table Builder (versions
CVE-2026-74003
CVE-2026-74003 is a Broken Access Control vulnerability in the RomethemeForm For Elementor WordPress plugin, affecting versions
CVE-2026-74003 WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability
Contributor Broken Access Control in RomethemeForm For Elementor = 1.2.6 versions...
CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...
CVE-2026-66640
Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...
CVE-2026-66639
WPZOOM Forms – Contact Form Plugin for Gutenberg (WordPress) contains a Contributor Cross Site Scripting (XSS) vulnerability affecting versions
EUVD-2026-60916
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...