WordPress Child Pages Card plugin < 1.09 - Contributor+ Stored XSS via Shortcode Attributes vulnerability

Contributor+ Stored XSS via Shortcode Attributes vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Child Pages Card versions 1.09...

WordPress Saitama Addon Pack plugin <= 1.0.8 - Contributor+ Stored XSS via Post Meta vulnerability

Contributor+ Stored XSS via Post Meta vulnerability discovered by testoun in WordPress Plugin Saitama Addon Pack versions = 1.0.8...

WordPress YMC Filter plugin < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema vulnerability

Contributor+ Stored XSS via Layout Builder Schema vulnerability discovered by Usama Arshad in WordPress Plugin Filter & Grids versions 3.12.8...

WordPress Slick Slider plugin < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode vulnerability

Contributor+ Stored XSS via Gallery Shortcode vulnerability discovered by testoun in WordPress Plugin Slick Slider versions 0.5.3...

WordPress Blubrry PowerPress plugin < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL vulnerability

Contributor+ Stored XSS via Podcast Episode Chapters URL vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin PowerPress Podcasting versions 11.16.11...

WordPress Classified Listing plugin < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts vulnerability

Contributor+ Unpublished Post Content Disclosure via rtclblockcssgetposts vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Classified Listing versions 5.4.4...

CVE-2026-19699

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account...

CVE-2026-17153

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

CVE-2026-19699

The GutenKit WordPress plugin (versions 2.4.12–2.4.15 , before 2.5.0) contains an insufficient capability check on certain REST API endpoints . This allows authenticated users with the Contributor role or higher to retrieve mailing-list audience metadata from the site's connected Mailchimp market...

CVE-2026-19699 GutenKit 2.4.12 - 2.4.15 - Contributor+ Mailchimp Audience Data Disclosure

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account...

CVE-2026-17153 AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

CVE-2026-17153

AI Agent by SiteGround plugin (≤1.2.7) has a missing authorization check on its /generate-content REST endpoint, allowing authenticated Contributor-level users to upload images to the media library despite lacking the upload_files capability. The sg_ai_studio_gutenberg_nonce is issued to any bloc...

CVE-2026-75963 Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the emesingleeventpagetemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .p...

CVE-2026-75963

The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...

CVE-2026-15446

The EWWW Image Optimizer WordPress plugin (all versions up to and including 8.7.3 ) is vulnerable to Stored Cross-Site Scripting via the data-script Lazy Load attribute in post content. The root cause is insufficient input sanitization and output escaping: an attacker with contributor-level acces...

EUVD-2026-62342

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-14825

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

CVE-2026-13175

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...