EUVD-2026-64788

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...

CVE-2026-78290 WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...

CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-78269 WordPress Shared Files plugin <= 1.7.69 - Server Side Request Forgery (SSRF) vulnerability

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

EUVD-2026-64834

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

CVE-2026-78269

CVE-2026-78269 is a Server Side Request Forgery (SSRF) vulnerability in the WordPress Shared Files plugin (versions

WordPress Eventin plugin < 4.1.21 - Contributor+ Server-Side Request Forgery vulnerability

Contributor+ Server-Side Request Forgery vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin WP Event SOlution versions 4.1.21...

PT-2026-80810

Contributor Server Side Request Forgery SSRF in Shared Files = 1.7.69 versions...

PT-2026-80817

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...

CVE-2026-77003

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

EUVD-2026-64637

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

EUVD-2026-64607

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-77003: Improper Privilege Management

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability...

PT-2026-79761

Name of the Vulnerable Software and Affected Versions Content Mask versions prior to 1.8.5.5 Description The Content Mask WordPress plugin fails to verify the necessary permissions required to publish the post type being created. This allows users with the Contributor role to publish posts and...

WordPress PPWP – Password Protect Pages plugin <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin PPWP versions = 1.9.18...

CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

CVE-2026-4559 Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute

The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'delay' shortcode attribute in all versions up to, and including, 3.6.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...