21741 matches found
WordPress Eventin plugin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability
Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.22...
CVE-2026-84901 Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...
CVE-2026-84926 EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route
The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from...
CVE-2026-84927
The EmbedPress WordPress plugin (versions 4.6.0-4.6.3 ) is vulnerable to a missing authorization check on one of its Google Reviews REST API routes. This flaw allows users with Contributor role privileges or higher to modify a site-wide store, which includes the ability to delete entries configur...
CVE-2026-84901
The Eventin WordPress plugin (versions before 4.1.22 ) contains a missing authorization vulnerability in several event-management REST routes . This flaw allows users with contributor-level access or higher to perform unauthorized actions, including changing the site's front-page setting to an ev...
EUVD-2026-71870
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which...
CVE-2026-84899
The VikWidgetsLoader WordPress plugin versions before 1.12.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to sanitize or escape a block attribute before outputting it within an inline script. This allows users with the Contributor role to store arb...
WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Administrator Email Disclosure vulnerability
Contributor+ Administrator Email Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...
EUVD-2026-71868
The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and delete global event a...
WordPress EmbedPress plugin 4.6.0-4.6.3 - Contributor+ Google Reviews Modification vulnerability
Contributor+ Google Reviews Modification vulnerability discovered by Artus KG in WordPress Plugin EmbedPress versions 4.6.0-4.6.3...
WordPress VikWidgetsLoader plugin < 1.12.0 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin VikWidgetsLoader versions 1.12.0...
CVE-2026-84899 VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix
The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...
CVE-2026-84899 VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix
The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...
CVE-2026-84745 The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
CVE-2026-84745 The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API
The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other...
EUVD-2026-71866
The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files...
CVE-2026-84898
The Eventin (also referred to as WP Event Solution ) WordPress plugin, versions prior to 4.1.21 , contains a local file inclusion (LFI) vulnerability. The root cause is a failure to properly validate a template path value before using it to include a local file. This flaw allows authenticated use...
EUVD-2026-71865
The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the affected page,...
WordPress King Addons for Elementor plugin < 51.1.77 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin King Addons for Elementor versions 51.1.77...
WordPress Eventin plugin < 4.1.21 - Contributor+ LFI vulnerability
Contributor+ LFI vulnerability discovered by Sai Praneeth Koti in WordPress Plugin WP Event Solution versions 4.1.21...