EUVD-2026-103220

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-91074: Improper Neutralization of Special Elements used in an SQL Command

The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...

PT-2026-116373

Name of the Vulnerable Software and Affected Versions BSK PDF Manager versions prior to 3.8.2 Description Authenticated users with contributor-level access and above can perform SQL injection attacks due to improper sanitization and escaping of a parameter used in a SQL statement. This issue occu...

PT-2026-116367

Name of the Vulnerable Software and Affected Versions Ukr-To-Lat versions prior to 1.3.6 Description Users with Contributor-level access and above can perform SQL injection attacks because the plugin fails to sanitize and escape a term name before incorporating it into a SQL query. Recommendation...

CVE-2026-109985: Improper Neutralization of Input During Web Page Generation

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-116358

Name of the Vulnerable Software and Affected Versions xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN versions prior to 1.4.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored...

CVE-2026-104122: Improper Neutralization of Special Elements used in an SQL Command

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-111628

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...

CVE-2026-111631

Distributor versions before 2.3.2 are vulnerable to a missing authorization flaw in external connection AJAX actions. This allows users with Contributor-level privileges to perform actions reserved for manage_options users. Specifically, an attacker can invoke dt_verify_external_connection with a...

EUVD-2026-103053

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...

CVE-2026-111631 Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...

CVE-2026-111631 Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions

Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manageoptions users. Attackers can call dtverifyexternalconnection with a chosen endpointId and url to send stored connection...

CVE-2026-111628 10up Distributor before 2.3.2 PHP Object Injection via set_meta()

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...

EUVD-2026-103050

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...

CVE-2026-111628

10up Distributor versions before 2.3.2 are vulnerable to a PHP object injection flaw. The root cause is the double unsererialization of distributed post meta within the set_meta() function located in includes/utils.php. This allows users with Contributor-level privileges to store a serialized PHP...

CVE-2026-111628 10up Distributor before 2.3.2 PHP Object Injection via set_meta()

10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers can store a serialized PHP string as meta, which setmeta in includes/utils.php unserializes on the...

CVE-2026-104726

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-102823

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-104726

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.34.2 . The root cause is insufficient input sanitization and output escaping specifically within the 'dir' shortcode attribute . An authenticated attacker with Contribu...

CVE-2026-104726 Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...