CVE-2026-16787

The Live Composer – Free WordPress Website Builder plugin (versions up to and including 2.1.19 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the dslc_custom_field shortcode, caused by insufficient input sanitization and output escaping . Authenticated attackers with contributor-level a...

CVE-2026-75965

The User Profile Builder WordPress plugin (versions ≤ 4.0.0 ) is vulnerable to Stored Cross-Site Scripting via the 'date' Shortcode Attribute , caused by insufficient input sanitization and output escaping in the format-date shortcode. Authenticated users with contributor-level access or higher c...

WordPress BetterDocs plugin <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin BetterDocs versions = 4.8.1...

WordPress User Profile Builder plugin <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'date' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Profile Builder versions = 4.0.0...

CVE-2026-12400-Exploit

CVE-2026-12400 — FlowForms IDOR : Modification de formulaire non autorisée Référence directe d'objet non sécurisée IDOR authentifiée Contributeur+ permettant la modification arbitraire de formulaire dans FlowForms ≤ 1.1.1 Aperçu de la vulnérabilité...

CVE-2026-14835

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

WordPress SOGO Add Script to Individual Pages Header Footer plugin <= 3.9 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin SOGO Add Script to Individual Pages Header Footer versions = 3.9...

CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

PT-2026-83523

Name of the Vulnerable Software and Affected Versions SOGO Add Script to Individual Pages Header Footer versions prior to 4.0 Description The plugin fails to sanitize or escape custom header and footer script values saved via the post metabox. Additionally, it does not restrict these actions to...

CVE-2026-76546

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortco...

CVE-2026-76546 Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortco...

CVE-2026-82227

Contributor SQL Injection in WPBulky = 1.2.2 versions...

CVE-2026-81759 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability

Contributor Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-81759

WpEvently is a WordPress plugin (by Mage EventPress) affected by a Broken Access Control vulnerability in versions

CVE-2026-82227

CVE-2026-82227 is a SQL Injection vulnerability in the WordPress plugin WPBulky (WP Bulk Edit Post Types), affecting versions 1.2.2 and earlier . The flaw requires Contributor-level privileges to exploit. CVSS 3.1 scores it 8.5 (HIGH) , with a changed scope, high impact on confidentiality, and lo...

CVE-2026-81284

CVE-2026-81284 affects the WordPress plugin ACF Extended in versions

CVE-2026-5510

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

CVE-2026-5510

GiveWP – Donation Plugin and Fundraising Platform for WordPress is vulnerable to Stored Cross-Site Scripting via the give_form shortcode in all versions up to and including 4.14.4 . The root cause is insufficient output escaping on the continue_button_title and display_style shortcode attributes,...

CVE-2026-5510 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

CVE-2026-15798

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...