CVE-2026-17123: Server-Side Request Forgery (SSRF)

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1064 via the Form Builder widget's 'webhookurl' setting. The widget's render method persists the attacker-controlled URL into the wprwebhookurlwidgetid option on ever...

CVE-2026-15604: Improper Neutralization of Input During Web Page Generation

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...

CVE-2026-15726: Improper Neutralization of Input During Web Page Generation

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-16779: Missing Authorization

The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-73096

Name of the Vulnerable Software and Affected Versions Podlove Podcast Publisher versions prior to 4.5.4 Description Insufficient file path validation in the create link item function allows authenticated attackers with contributor-level access or higher to delete arbitrary files on the server. Th...

PT-2026-73084

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin versions prior to 1.6.12.11 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key within ssa past appointments...

PT-2026-73107

Name of the Vulnerable Software and Affected Versions Toocheke Companion versions prior to 2.11 Description The Toocheke Companion plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the toocheke series bg color save function fails to properly sanitize input fro...

CVE-2026-18438

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetchremotefile function. This is due to a filename validation/destination mismatch ...

CVE-2026-18438

The CVE-2026-18438 entry concerns the Templately – Elementor & Gutenberg Template Library WordPress plugin (versions up to 3.7.1). Root cause: a filename validation/destination mismatch in fetch_remote_file causes the destination path to be derived from the URL, while the Content-Disposition file...

CVE-2026-18438 Templately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetchremotefile function. This is due to a filename validation/destination mismatch ...

CVE-2026-18807 ECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers

The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...

EUVD-2026-59592

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...

CVE-2026-18807

The ECS WordPress plugin (specifically Ele Custom Skin for Elementor ) versions prior to 4.3.8 is vulnerable to a missing authorization flaw. The plugin fails to perform adequate capability or ownership checks on its dynamic repeater actions , relying solely on a nonce accessible to any user capa...

CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

EUVD-2026-59588

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

CVE-2026-18807: Missing Authorization

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...

CVE-2026-14230: Improper Neutralization of Input During Web Page Generation

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

PT-2026-72162

Name of the Vulnerable Software and Affected Versions ECS WordPress plugin versions prior to 4.3.8 Description Insufficient capability and object-ownership checks in Dynamic Repeater AJAX handlers allow a user with Contributor privileges to inject data-source bindings into any post, including tho...

PT-2026-72881

Name of the Vulnerable Software and Affected Versions Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! versions prior to 3.7.2 Description Authenticated attackers with contributor-level access and above can achieve remote code execution via the fetc...

WordPress Embed Google Photos Album Easily plugin <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute vulnerability

Contributor+ Stored XSS via link Shortcode Attribute vulnerability discovered by testoun in WordPress Plugin Embed Google Photos album versions = 2.2.1...