CVE-2026-94500

The ElementsKit Elementor addons Lite WordPress plugin is vulnerable to a Contributor Cross Site Scripting (XSS) vulnerability in versions

CVE-2026-94168

The Premium Addons for Elementor WordPress plugin (versions

EUVD-2026-85472

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

EUVD-2026-85467

Contributor SQL Injection in Mollie Forms = 2.11.0 versions...

CVE-2026-93773

The Mollie Forms WordPress plugin (versions

CVE-2026-93527 WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability

Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...

CVE-2026-93527

The Live Copy Paste for Elementor WordPress plugin, versions

EUVD-2026-85460

Contributor SQL Injection in Live Copy Paste for Elementor = 1.5.10 versions...

WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Summary WPGraphQL 2.19.0 contains an authorization bypass in the updatePost mutation. An authenticated WordPress Contributor can change one of their own draft posts to PUBLISH despite lacking the publishposts capability. The same mutation also permits the Contributor to modify their own previousl...

GHSA-5MMC-8PC9-WGGG WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

Summary WPGraphQL 2.19.0 contains an authorization bypass in the updatePost mutation. An authenticated WordPress Contributor can change one of their own draft posts to PUBLISH despite lacking the publishposts capability. The same mutation also permits the Contributor to modify their own previousl...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the updatePost process. An attacker can alter the publication status or content of their own posts without the required editorial approval by submitting crafted GraphQL mutations as an authenticated Contributo...

CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

EUVD-2026-85310

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

CVE-2026-88974

The WPGraphQL plugin (prior to version 2.22.2 ) contains an authorization bypass in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The root cause is that the mutation only validates the collection-level edit_posts capability and post authorship, failing to enforce object-level ...

CVE-2026-88974 WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level editposts capability and the post author, but does not enforce the object-level editpost capability or require publishposts for publ...

CVE-2026-5924

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.3 . The flaw exists within the Google Maps block due to the customStyle attribute, where the mapStyles() function in the frontend JavaScript uses eval() on...

CVE-2026-6831 Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

EUVD-2026-85112

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-6831 Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-5924 Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval on user-controlled block content in the frontend JavaScript mapStyles...