21725 matches found
CVE-2026-90884: Improper Neutralization of Input During Web Page Generation
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...
PT-2026-95269
Name of the Vulnerable Software and Affected Versions Magazine Blocks versions prior to 1.8.7 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the NewsTicker::render function. The clientId attribute of the News Ticker block is concatenat...
PT-2026-95285
Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.8.5 Description Stored Cross-Site Scripting occurs via the kubio/copyright Block Content due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level acces...
WordPress Core <= 7.1 - Contributor+ Arbitrary Post Overwrite vulnerability
Contributor+ Arbitrary Post Overwrite vulnerability discovered by Anthropic in WordPress core versions = 7.1...
PT-2026-95234
Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description An issue exists where the software fails to perform an object-level authorization check during the import of template content into a page. This allows users with contributor-level...
PT-2026-95290
Name of the Vulnerable Software and Affected Versions WP Inventory Manager versions prior to 2.5.2 Description Authenticated attackers with Contributor-level access and above can perform SQL Injection through the where shortcode attribute of the wpinventory shortcode. The issue occurs in the...
CVE-2026-12106: Server-Side Request Forgery (SSRF)
The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2 via the downloadImage function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitra...
CVE-2026-88994: Improper Control of Filename for Include/Require Statement in PHP Program
The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...
PT-2026-95344
Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injectin...
WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure
Description WordPress does not check that the user is allowed to access a post before returning its sample permalink in some cases, which could allow users with a role as low as contributor to retrieve the titles of other users' draft and pending posts...
WP < 7.1.1 - Contributor+ Arbitrary Post Modification
Description WordPress does not properly verify that a user is allowed to edit a post when handling a post creation request that names an existing post in some cases, which could allow users with a role as low as contributor to overwrite the title, content and author of any post, including those...
CVE-2026-75017: Missing Authorization
The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.6. This is due to the plugin not properly verifying that a user is authorized t...
CVE-2026-2585 Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WordPress WP Recipe Maker plugin <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Saulo Rafael miquinho miquinho in WordPress Plugin WP Recipe Maker versions = 10.8.1...
WordPress Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Popup Maker versions = 1.24.0...
WordPress Kubio AI Page Builder plugin <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Kubio AI Page Builder versions = 2.8.4...
WordPress Strong Testimonials plugin <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by pbsec in WordPress Plugin Strong Testimonials versions = 3.3.8...
WordPress Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Magazine Blocks versions = 1.8.6...
WordPress Download Manager plugin <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure vulnerability
Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Disclosure vulnerability discovered by pbsec in WordPress Plugin Download Manager versions = 3.3.68...
