CVE-2026-14195: Authorization Bypass Through User-Controlled Key

The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...

PT-2026-67132

Name of the Vulnerable Software and Affected Versions Kadence Blocks — Page Builder Toolkit for Gutenberg Editor versions prior to 3.7.9 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Si...

CVE-2026-10827: Insufficient Verification of Data Authenticity

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

CVE-2026-13458: Improper Neutralization of Input During Web Page Generation

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-67079

Name of the Vulnerable Software and Affected Versions Advanced Woo Labels – Product Labels & Badges for WooCommerce versions prior to 2.49 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored...

PT-2026-67095

The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messagesid' Parameter in all versions up to, and including, 3.1.42 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

PT-2026-66894

Name of the Vulnerable Software and Affected Versions Subscriptions for WooCommerce versions prior to 2.0.1 Description An issue exists where authenticated users with Contributor-level access or higher can escalate their privileges to Administrator. This occurs because the save meta boxes functio...

WordPress Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Advanced Woo Labels versions = 2.48...

WordPress Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection vulnerability

Authenticated Contributor+ Second-Order SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Icegram versions = 3.1.42...

WordPress GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GamiPress versions = 7.9.9.1...

WordPress GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin GamiPress versions = 7.9.9.1...

WordPress Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin <= 3.1.1 - Authenticated (Contributor+) Exposure of Sensitive Information vulnerability

Authenticated Contributor+ Exposure of Sensitive Information vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Jeg Kit for Elementor versions = 3.1.1...

WordPress SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin SureForms versions = 2.8.1...

CVE-2026-15258

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

CVE-2026-14931

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

CVE-2026-14931 JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

EUVD-2026-51424

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

CVE-2026-14931 JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

CVE-2026-14931

The JS Help Desk WordPress plugin, in versions prior to 3.1.4 , contains a vulnerability where the Contributor role is granted the support-agent capability upon activation. Due to a missing capability check on a user-listing handler , users with Contributor-level privileges can enumerate the emai...

CVE-2026-15258

The Product Feed Manager For WooCommerce WordPress plugin, in versions prior to 7.6.1 , is vulnerable to SQL injection . The root cause is the improper sanitization and escaping of product-feed custom filter rules before they are utilized in a SQL query. This flaw allows users with the Contributo...