CVE-2026-1641

The Wow Elements Addons for Elementor plugin for WordPress is affected by a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.11.2 . The root cause is the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get func...

EUVD-2026-83547

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset...

CVE-2026-77820

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-83465

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-92807: Improper Control of Generation of Code

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdfcreatedcallback shortcode attribute. The evalshortcode function copies any non-button/non-email shortcode attribute verbatim into a custom...

PT-2026-95783

Name of the Vulnerable Software and Affected Versions Wow Elements Addons for Elementor versions prior to 1.11.3 Description This issue is a Server-Side Request Forgery, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated...

CVE-2026-8354: Improper Neutralization of Input During Web Page Generation

The Gum Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poptag' parameter in all versions up to, and including, 1.3.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-95786

Name of the Vulnerable Software and Affected Versions WP Composer – The Easiest Page Builder versions prior to 1.0.6 Description Stored Cross-Site Scripting occurs via the pbwp raw shortcode shortcode. The shortcode handler decodes Base64-encoded content and outputs it directly without sanitizati...

CVE-2026-9855: Improper Neutralization of Special Elements used in an SQL Command

The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'postID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2026-95747

Name of the Vulnerable Software and Affected Versions Save as PDF Plugin by PDFCrowd versions prior to 4.6.2 Description The plugin is susceptible to Arbitrary Function Invocation. The eval shortcode function copies shortcode attributes into a custom options array without sanitization or capabili...

CVE-2026-15098: Improper Neutralization of Input During Web Page Generation

The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by onshortcode in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping...

CVE-2026-2422: Improper Neutralization of Input During Web Page Generation

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwprawshortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without an...

PT-2026-95804

Name of the Vulnerable Software and Affected Versions Gum Addon for Elementor versions prior to 1.3.16 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary we...

PT-2026-95778

Name of the Vulnerable Software and Affected Versions Real3D Flipbook Lite versions prior to 5.1.2 Description Stored Cross-Site Scripting is possible due to insufficient input sanitization and output escaping in the on shortcode and print global options functions. The issue occurs when shortcode...

PT-2026-95798

Name of the Vulnerable Software and Affected Versions Custom Field Template versions prior to 2.7.9 Description Authenticated attackers with contributor-level access and above can perform a generic SQL Injection. This occurs because the post ID parameter is not sufficiently escaped and the SQL...

PT-2026-95733

Name of the Vulnerable Software and Affected Versions WPComplete versions prior to 2.9.9.1 Description The pro version of the WPComplete plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping when handling the empt...

PT-2026-95795

Name of the Vulnerable Software and Affected Versions Easy Appointments versions prior to 3.12.28 Description The plugin is subject to sensitive information exposure through the handle customers ajax function. Authenticated attackers with contributor-level access or higher can extract the complet...

CVE-2026-90884

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2026-15797

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-82854

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via posttitle in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it...