CVE-2026-89000 WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only...

WordPress EmbedPress plugin < 4.6.7 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dthangws in WordPress Plugin EmbedPress versions 4.6.7...

CVE-2026-85002 EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

EUVD-2026-87888

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-85002 EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes

The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the post...

CVE-2026-97319: Improper Neutralization of Input During Web Page Generation

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

PT-2026-99500

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.27 Description The plugin fails to sanitize imported feed content before it is stored as post content. This allows users with the Contributor role or higher to execute Stored Cross-Site Scriptin...

PT-2026-99497

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.27 Description The plugin fails to perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side. This allows users with contributor-level...

CVE-2026-89006: Improper Neutralization of Input During Web Page Generation

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-89000: Server-Side Request Forgery (SSRF)

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to internal-only...

PT-2026-99493

Name of the Vulnerable Software and Affected Versions EmbedPress versions prior to 4.6.7 Description Insufficient escaping of a block attribute before it is output within an HTML attribute allows users with the contributor role or higher to execute Stored Cross-Site Scripting XSS attacks. This...

CVE-2026-89001: Improper Privilege Management

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or to attribute posts to another account, allowing users with contributor-level access and above to publish posts live and set any registered user,...

PT-2026-99503

Name of the Vulnerable Software and Affected Versions WP YouTube Lyte WordPress plugin versions prior to 1.7.31 Description Insufficient escaping of attributes within YouTube embed blocks occurs during the rendering process when they are outputted into an HTML attribute. This flaw allows users wi...

CVE-2026-96895: Improper Neutralization of Input During Web Page Generation

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks...

PT-2026-99498

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.27 Description The plugin fails to verify if a user managing a feed campaign has the necessary permissions to publish content or attribute posts to other accounts. This allows users with...

CVE-2026-89003: Server-Side Request Forgery (SSRF)

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering the response, allowing users with contributor-level access and above to force the server to issue requests to internal-only hosts and read the...

PT-2026-99499

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.27 Description The plugin fails to perform a capability check before fetching a user-supplied URL and rendering the response. This allows users with contributor-level access and above to force t...

CVE-2026-96525

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-96526

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

WordPress MCP Server for WordPress plugin < 1.8.2 - Contributor+ Workflow Modification and Deletion vulnerability

Contributor+ Workflow Modification and Deletion vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...