PT-2026-68593

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks by Kadence Blocks versions prior to 3.7.9 Description An issue exists that allows for the exposure of sensitive data to users with contributor-level permissions. Recommendations Update Gutenberg Blocks by Kadence Blocks to...

CVE-2026-28111: Incorrect Privilege Assignment

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2025-15674: Incorrect Authorization

The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...

CVE-2026-14225: Improper Input Validation

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

WP < 7.0.3 - Contributor+ Stored XSS via Emoji Settings Element

Description WordPress does not properly restrict the content of submitted posts in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against users previewing the post...

PT-2026-68470

Name of the Vulnerable Software and Affected Versions PostX versions prior to 5.0.14 Description The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and outp...

CVE-2026-5158: Improper Neutralization of Input During Web Page Generation

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by alexhenry20 in WordPress Plugin LatePoint versions = 5.3.2...

WordPress Post Grid Gutenberg Blocks – PostX plugin <= 5.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin PostX versions = 5.0.13...

CVE-2026-7441

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

CVE-2026-16968

The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators...

CVE-2026-6972

The CVE-2026-6972 entry concerns the SKT Skill Bar WordPress plugin (

CVE-2026-7441

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-7441

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

EUVD-2026-53185

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the posttype attribute of the SimpleYearlyArchive shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This make...

EUVD-2026-53186

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

CVE-2026-16968 GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users

The GeoDirectory WordPress plugin before 2.8.168 does not restrict a user-search handler to users allowed to list users, allowing any authenticated user with Contributor-level access or higher to retrieve the email addresses of all registered users, including administrators...

CVE-2026-16968

The GeoDirectory WordPress plugin versions before 2.8.168 contains a vulnerability where the geodir_json_search_users handler fails to restrict access to users who are authorized to list users. This oversight allows any authenticated user with Contributor-level access or higher to retrieve the em...

CVE-2026-15941 Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

CVE-2026-15941 Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...