CVE-2026-5336

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

CVE-2026-5336 Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.43 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Webbernaut in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.43...

CVE-2026-66696

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...

CVE-2026-28111

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

EUVD-2026-53907

Contributor Cross Site Scripting XSS in MailOptin = 1.2.78.0 versions...

CVE-2026-66696

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...

EUVD-2026-53903

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...

CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

EUVD-2026-53941

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2026-5391

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

WordPress Simple Restrict plugin < 1.2.9 - Contributor+ Restricted Content Disclosure vulnerability

Contributor+ Restricted Content Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Simple Restrict versions 1.2.9...

EUVD-2026-53863

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-53864

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

CVE-2026-5391

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

CVE-2026-5158

The CVE-2026-5158 affects the WordPress PostX plugin (Post Grid Gutenberg Blocks for News, Magazines, Blog Websites). It describes a Stored Cross-Site Scripting vulnerability in the inputPlaceHolder parameter present in all versions up to 5.0.13, caused by insufficient input sanitization and outp...

CVE-2026-16537

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...

EUVD-2026-53733

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...

CVE-2026-18395 Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes

The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-16537 Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode

The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...