EUVD-2026-39956

The Surbma | Infusionsoft Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'infusionsoft-form' shortcode in versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on user-supplied 'account' and 'id' shortcode...

CVE-2026-13295

The CVE-2026-13295 entry concerns the Page Builder by SiteOrigin WordPress plugin. A stored XSS vulnerability affects all versions up to 2.34.3, caused by insufficient input sanitization and output escaping of the panels_data parameter. Authenticated users with Contributor-level access and above ...

EUVD-2026-39952

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...

EUVD-2026-39929

The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpmpoint' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-13335

The CodePeople Post Map for Google Maps WordPress plugin is vulnerable to Stored XSS via the 'cpm_point' Post Meta in all versions up to 1.2.6 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary scripts t...

CVE-2026-57651

Contributor Cross Site Scripting XSS in Ghost Kit = 3.6.0 versions...

CVE-2026-57648

Contributor Broken Access Control in Nelio Content = 4.3.4 versions...

CVE-2026-57636

Contributor SQL Injection in wpForo Forum = 3.0.9 versions...

CVE-2026-57638

Contributor Cross Site Scripting XSS in Fluent Booking = 2.1.0 versions...

CVE-2026-57321

Contributor Arbitrary File Deletion in H5P = 1.17.7 versions...

CVE-2026-56038

Contributor Privilege Escalation in Frisbii Pay = 1.8.2 versions...

CVE-2026-56008

Contributor Privilege Escalation in Fusion Builder = 3.15.4 versions...

EUVD-2026-39667

Contributor SQL Injection in Contest Gallery = 30.0.0 versions...

EUVD-2026-39765

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.3 versions...

EUVD-2026-39762

Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer = 1.6.1 versions...

EUVD-2026-39757

Contributor SQL Injection in Gallery = 4.7.8 versions...

EUVD-2026-39752

Contributor SQL Injection in wpForo Forum = 3.0.9 versions...

EUVD-2026-39750

Contributor Insecure Direct Object References IDOR in PPWP = 1.9.19 versions...

EUVD-2026-39733

Contributor Arbitrary File Deletion in H5P = 1.17.7 versions...