CVE-2026-75963

The Events Made Easy WordPress plugin (all versions up to and including 3.2.5 ) is vulnerable to Local File Inclusion via the eme_single_event_page_template function, specifically through the wp_page_template event property. Authenticated attackers with contributor-level access or above can injec...

PT-2026-78887

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...

WordPress Brizy - Page Builder plugin < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point vulnerability

WordPress Brizy - Page Builder plugin 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Brizy versions 2.8.19...

WordPress Classified Listing plugin < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search vulnerability

Contributor+ Store Revenue Total Disclosure via rtclrevenueordersearch vulnerability discovered by Huseyin Mertoglu in WordPress Plugin Classified Listing versions 5.4.4...

WordPress BNE Testimonials plugin < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode vulnerability

Contributor+ Stored XSS via Slider Shortcode vulnerability discovered by testoun in WordPress Plugin BNE Testimonials versions 2.0.8.2...

WordPress s2Member plugin < 260805 - Contributor+ Stored XSS via Shortcode vulnerability

Contributor+ Stored XSS via Shortcode vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin s2Member versions 260805...

WordPress Quiz And Survey Master plugin < 11.2.2 - Contributor+ Stored XSS via Polar Question vulnerability

Contributor+ Stored XSS via Polar Question vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Quiz And Survey Master versions 11.2.2...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446

The EWWW Image Optimizer WordPress plugin (all versions up to and including 8.7.3 ) is vulnerable to Stored Cross-Site Scripting via the data-script Lazy Load attribute in post content. The root cause is insufficient input sanitization and output escaping: an attacker with contributor-level acces...

EUVD-2026-62342

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-14825

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

CVE-2026-13175

The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contributor-level access and above to alter or delete schedule entries created by other users...

CVE-2026-13173

The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata during speaker creation, allowing users with contributor-level access and above to modify other users' roles and metadata...

CVE-2026-19406

The Easy Appointments WordPress plugin (versions before 4.0.1 ) contains a sensitive information disclosure vulnerability. The root cause is a failure to restrict one of its appointment-listing REST endpoints to records belonging only to the requesting user. Consequently, users with contributor-l...

CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-14825 Quiz And Survey Master < 11.2.4 - Contributor+ Arbitrary Quiz Text Settings Update via IDOR

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings, allowing users with contributor-level access and above to modify the text settings of quizzes created by other users...

CVE-2026-14825

The Quiz and Survey Master (QSM) WordPress plugin (versions before 11.2.4 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to perform a per-object ownership check when saving a quiz's front-end text settings. This allows users with contributor-level access or ...