WordPress Paymob for WooCommerce plugin < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification vulnerability

Contributor+ Payment Gateway Configuration Deletion and Modification vulnerability discovered by ryan fabella in WordPress Plugin Paymob for WooCommerce versions 4.1.14...

CVE-2026-85006 Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

WordPress HappyAddons for Elementor plugin < 3.50.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Happy Addons for Elementor versions 3.50.0...

CVE-2026-85006 Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

WordPress The Events Calendar plugin 6.15.16.1-6.17.4 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover vulnerability

Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin The Events Calendar versions 6.15.16.1-6.17.4...

CVE-2026-84742

The Events Calendar WordPress plugin, affecting versions 6.15.0 through 6.17.4 , contains an incorrect authorization vulnerability. The plugin fails to verify the necessary capabilities required to publish content when creating or updating entries via its REST API . This allows users with restric...

EUVD-2026-85039

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review...

WordPress The Events Calendar plugin 6.15.0-6.17.4 - Contributor+ Content Publication vulnerability

Contributor+ Content Publication vulnerability discovered by Jashid Sany in WordPress Plugin The Events Calendar versions 6.15.0-6.17.4...

PT-2026-97456

Name of the Vulnerable Software and Affected Versions Premium Blocks – Gutenberg Blocks for WordPress versions prior to 2.3.18 Description An issue exists that allows a user with contributor privileges to perform Cross Site Scripting XSS, a technique where malicious scripts are injected into...

PT-2026-97471

Name of the Vulnerable Software and Affected Versions Podcast Importer SecondLine versions prior to 1.5.7 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than...

CVE-2026-91077: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-94124: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

PT-2026-97177

Name of the Vulnerable Software and Affected Versions HappyAddons for Elementor versions prior to 3.50.0 Description An issue exists where an icon value in a button widget is not properly escaped before being output within an HTML attribute. This allows users with Contributor-level access or high...

PT-2026-97457

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

PT-2026-97202

Name of the Vulnerable Software and Affected Versions Getwid – Gutenberg Blocks versions prior to 2.1.4 Description Stored Cross-Site Scripting occurs via the 'customStyle' attribute of the Google Maps block. The issue stems from the use of the eval function on user-controlled block content withi...

PT-2026-97336

Name of the Vulnerable Software and Affected Versions WPGraphQL versions prior to 2.22.2 Description An authorization bypass exists in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The system only verifies the collection-level edit posts capability and the post author, failing...

CVE-2026-6831: Missing Authorization

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-93507: Missing Authorization

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-88997: Improper Neutralization of Input During Web Page Generation

The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...

CVE-2026-87981: Missing Authorization

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...