CVE-2026-15798: Improper Neutralization of Input During Web Page Generation

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-5510: Improper Neutralization of Input During Web Page Generation

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

PT-2026-83157

Contributor SQL Injection in WPBulky = 1.2.2 versions...

WordPress Post Duplicator plugin <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution vulnerability

Missing Authorization to Authenticated Contributor+ Post Duplication with Arbitrary Author Attribution vulnerability discovered by Abi Wiranata in WordPress Plugin Post Duplicator versions = 3.0.11...

EUVD-2026-66954

Contributor SQL Injection in Suggestion Engine for WooCommerce = 2.0.11 versions...

WordPress Reviews and Rating - Google Reviews plugin <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes vulnerability

WordPress Reviews and Rating - Google Reviews plugin = 5.10 - Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Shortcodes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Reviews and Rating – Google My Business versions = 5.10...

CVE-2026-3002

Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin is vulnerable to Stored Cross-Site Scripting in multiple blocks (including animated-text, team, and chart) in all versions up to and including 4.0.2 . The root cause is insufficient input sanitization and output escaping , allow...

CVE-2026-6178: Improper Neutralization of Input During Web Page Generation

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'iconbox2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVE-2026-3002: Improper Neutralization of Input During Web Page Generation

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-2388: Improper Neutralization of Input During Web Page Generation

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags a...

CVE-2026-76128: Improper Neutralization of Input During Web Page Generation

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-18100: Improper Neutralization of Input During Web Page Generation

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mfformid' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-75019: Improper Neutralization of Input During Web Page Generation

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

CVE-2026-4559: Improper Neutralization of Input During Web Page Generation

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-4245: Incorrect Authorization

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the duplicatepostpermissions permission callback only verifying the duplicateposts capability without checking whether the requesting user holds publishposts...

EUVD-2026-63937

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

WordPress Quiz And Survey Master plugin < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR vulnerability

Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Quiz And Survey Master versions 11.2.4...

CVE-2026-13176: Server-Side Request Forgery (SSRF)

The Eventin WordPress plugin before 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts...

CVE-2026-76613: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries...

WordPress ECS plugin < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source vulnerability

Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source vulnerability discovered by Erwan LR WPScan in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.10...