PT-2026-68505

Name of the Vulnerable Software and Affected Versions Forminator versions prior to 1.57.0 Description An issue exists that allows a user with Contributor privileges to escalate their privileges within the system. Recommendations Update to a version newer than 1.56.0...

PT-2026-68471

Name of the Vulnerable Software and Affected Versions LatePoint versions prior to 5.3.3 Description Stored Cross-Site Scripting occurs when authenticated attackers with contributor level access or higher inject arbitrary web scripts into pages. This issue stems from insufficient input sanitizatio...

PT-2026-68593

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks by Kadence Blocks versions prior to 3.7.9 Description An issue exists that allows for the exposure of sensitive data to users with contributor-level permissions. Recommendations Update Gutenberg Blocks by Kadence Blocks to...

CVE-2026-28111: Incorrect Privilege Assignment

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2025-15674: Incorrect Authorization

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

WP < 7.0.3 - Contributor+ Stored XSS via Emoji Settings Element

Description WordPress does not properly restrict the content of submitted posts in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against users previewing the post...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by alexhenry20 in WordPress Plugin LatePoint versions = 5.3.2...

WordPress Post Grid Gutenberg Blocks – PostX plugin <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin PostX versions = 5.0.13...

CVE-2026-7441

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2026-16968

The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators...

EUVD-2026-53185

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

EUVD-2026-53186

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

CVE-2026-7441

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2026-7441

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-6972

The CVE-2026-6972 entry concerns the SKT Skill Bar WordPress plugin (

CVE-2026-16968 GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users

The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators...

CVE-2026-16968

The GeoDirectory WordPress plugin versions before 2.8.168 contains a vulnerability where the geodir_json_search_users handler fails to restrict access to users who are authorized to list users. This oversight allows any authenticated user with Contributor-level access or higher to retrieve the em...

CVE-2026-15941 Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

CVE-2026-15941 Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

PT-2026-68035

Name of the Vulnerable Software and Affected Versions SKT Skill Bar versions prior to 2.7 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping of the chart size attribute within the skillwrapper shortcode. The attribute is concatenated directly...