CVE-2026-65473

Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12 versions...

CVE-2026-65458

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5...

CVE-2026-65450

Contributor SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-57696

Contributor Arbitrary File Deletion in Picture Gallery = 1.6.5 versions...

CVE-2026-27403

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3...

CVE-2026-65535

Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...

EUVD-2026-48136

Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...

CVE-2026-65533

Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...

CVE-2026-65526 WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1...

EUVD-2026-48124

Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...

CVE-2026-65518

Contributor Cross Site Scripting XSS in Accept Donations with PayPal & Stripe = 1.5.5 versions...

EUVD-2026-48092

Contributor Local File Inclusion in Vino = 1.9 versions...

CVE-2026-65480

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1...

CVE-2026-65477

Contributor Local File Inclusion in Tonda Core = 2.1.2 versions...

CVE-2026-65473

Contributor Cross Site Scripting XSS in Virtue/Ascend/Pinnacle Toolkit = 4.9.12 versions...

EUVD-2026-48223

Contributor Sensitive Data Exposure in Polylang = 3.8.5 versions...

CVE-2026-15794

The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15646

The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15404

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

CVE-2026-13119

The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtecrecordsedit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $POST'standard' and uses the JS...