EUVD-2026-76210

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

CVE-2026-62110

CVE-2026-62110 is a Contributor-level Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder WordPress plugin, affecting versions 5.9.9 and earlier . The flaw was discovered by LevinityCyber and assigned a CVSS 3.1 score of 6.5 (MEDIUM) with a changed scope, requiring user interaction ...

CVE-2026-62110 WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Bold Page Builder = 5.9.9 versions...

WordPress Registration Form for WooCommerce plugin 1.1.0-1.1.2 - Contributor+ Privilege Escalation vulnerability

Contributor+ Privilege Escalation vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Registration Form for WooCommerce versions 1.1.0-1.1.2...

WordPress Visualizer plugin < 4.0.6 - Contributor+ Arbitrary Chart Deletion vulnerability

Contributor+ Arbitrary Chart Deletion vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Visualizer versions 4.0.6...

CVE-2026-6640

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress All in One SEO plugin < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block vulnerability

Contributor+ Stored XSS via ai-assistant Block vulnerability discovered by Asaf Mozes in WordPress Plugin All In One SEO Pack versions 5.0.0.1...

CVE-2026-6640 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-76009

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-6640 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-6640

The Media Library Assistant WordPress plugin is vulnerable to Stored Cross-Site Scripting via the mla_link_attributes parameter in all versions up to and including 3.35 , caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher...

CVE-2026-6641

Media Library Assistant is a WordPress plugin vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.35 . The flaw resides in the mla_gallery shortcode: when the mla_output parameter is set to paginate_links, the mla_link_href parameter is processed by _paginate_links()...

EUVD-2026-76007

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

CVE-2026-85678

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

CVE-2026-83546

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-86779

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...

CVE-2026-86780

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

CVE-2026-86782

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...

CVE-2026-83545

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

CVE-2026-86782 Visualizer < 4.0.6 - Contributor+ Arbitrary Post/Page Modification via IDOR

The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and above to publish, rename, and overwrite the content of posts and pages they do not own, including other users' private drafts...