CVE-2026-12230 LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layoutcustomcss' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-72695

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502 Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

CVE-2026-16502

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.18) is vulnerable to PHP Object Injection via deserialization of untrusted input introduced through a shortcode. Authenticated attackers with contributor-level access or above can inject a PHP object. Critically, no known P...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, pero luego inserta $entry-metakey directamente en la cadena SQL sin escaparla: root@kitploit: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Dado que metakey proviene de la base de datos, el código lo...

CVE-2026-12400-Exploit

CVE-2026-12400 — FlowForms IDOR: 不正なフォーム変更 認証済み（Contributor+）によるFlowForms ≤ 1.1.1 における安全でない直接オブジェクト参照による任意のフォーム変更 脆弱性の概要...

CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare 安全地获取行，但随后将 $entry-metakey 直接拼入 SQL 字符串而未转义： root@kitploit: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; 由于 metakey 来自数据库，代码将其视为可信数据。但贡献者可以通过自定义字段面板设置任意字段名——因此他们可以控制该列中的内容。 攻击分两步： 1. 写入：...

CVE-2026-11991-Exploit

CVE-2026-11991 — FlowForms 未授权表单发布 已认证（贡献者及以上）授权绕过，可在 FlowForms ≤ 1.1.1 中发布任意草稿表单 漏洞概述 属性| 值 ---|--- CVE ID| CVE-2026-11991 CVSS 评分| 6.2 — 中危 CVSS 向量| AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:H/RL:O/RC:C CWE| CWE-639（通过用户可控密钥绕过授权） 产品| FlowForms — WordPress 对话式表单构建插件 受影响版本| 所有版本，最高至 1.1.1 修复版本| 1.1.2...

CVE-2026-12853 Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

EUVD-2026-72365

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-2390

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

EUVD-2026-72350

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

CVE-2026-2390 Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

CVE-2026-2390

The Powerkit WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via its Lazy Load module's image processing in all versions up to and including 3.0.4 . The root cause is the content_process_images function, which relies on a flawed regex-based HTML attribute parser, allowing auth...

WordPress Flamingo plugin <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search vulnerability

Authenticated Contributor+ Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search vulnerability discovered by jopet in WordPress Plugin Flamingo versions = 2.6.2...

WordPress Powerkit plugin <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Lazy Load Image Processing vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Powerkit versions = 3.0.4...

VulnCheck KEV: CVE-2025-6068

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-caption-title & data-caption-description HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muni Nitish Kumar Yaddala Stranger825, Revanth Matte in WordPress Plugin LearnPress versions = 4.3.9.1...

WordPress Live Composer – Free WordPress Website Builder plugin <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Page Builder: Live Composer versions = 2.1.18...

CVE-2026-84028

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...