CVE-2026-76546: Improper Neutralization of Input During Web Page Generation

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortco...

CVE-2026-82227

Contributor SQL Injection in WPBulky = 1.2.2 versions...

CVE-2026-81759

Contributor Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-81284

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

EUVD-2026-67731

Contributor Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-81759

WpEvently is a WordPress plugin (by Mage EventPress) affected by a Broken Access Control vulnerability in versions

CVE-2026-81759 WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability

Contributor Broken Access Control in WpEvently = 5.5.0 versions...

CVE-2026-82227

CVE-2026-82227 is a SQL Injection vulnerability in the WordPress plugin WPBulky (WP Bulk Edit Post Types), affecting versions 1.2.2 and earlier . The flaw requires Contributor-level privileges to exploit. CVSS 3.1 scores it 8.5 (HIGH) , with a changed scope, high impact on confidentiality, and lo...

CVE-2026-81284 WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-82227 WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerability

Contributor SQL Injection in WPBulky = 1.2.2 versions...

EUVD-2026-67727

Contributor Broken Access Control in ACF Extended = 0.9.2.6 versions...

CVE-2026-81284

CVE-2026-81284 affects the WordPress plugin ACF Extended in versions

EUVD-2026-67726

Contributor SQL Injection in WPBulky = 1.2.2 versions...

WordPress Content Mask plugin 1.8.0-1.8.5.4 - Contributor Publish Capability Bypass vulnerability

Contributor Publish Capability Bypass vulnerability discovered by Pablo González and Fran Ramírez in WordPress Plugin Content Mask versions 1.8.0-1.8.5.4...

CVE-2026-5510

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

CVE-2026-79615

The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other...

CVE-2026-5510 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

CVE-2026-5510

GiveWP – Donation Plugin and Fundraising Platform for WordPress is vulnerable to Stored Cross-Site Scripting via the give_form shortcode in all versions up to and including 4.14.4 . The root cause is insufficient output escaping on the continue_button_title and display_style shortcode attributes,...

CVE-2026-5510 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

WordPress GiveWP plugin <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by daroo in WordPress Plugin GiveWP versions = 4.14.4...