CVE-2026-96526 MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

WordPress MCP Server for WordPress plugin < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure vulnerability

Contributor+ Arbitrary Post Title Disclosure vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...

CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

CVE-2026-92411 WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

EUVD-2026-87535

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

CVE-2026-92411 WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

CVE-2026-96526 MCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-92411

The WP Delicious WordPress plugin (versions prior to 1.10.8 ) is vulnerable to Stored XSS . The root cause is a failure to validate or escape the HTML tag name extracted from user-supplied recipe block data before it is rendered on the front end. This allows authenticated users with the Contribut...

CVE-2026-96525 MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

EUVD-2026-87537

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

WordPress MCP Server for WordPress plugin < 1.8.2 - Contributor+ Workflow Modification and Deletion vulnerability

Contributor+ Workflow Modification and Deletion vulnerability discovered by Raphael P. Cigana in WordPress Plugin MCP Server for WordPress versions 1.8.2...

CVE-2026-96526

The MCP Server for WordPress plugin for WordPress, in versions before 1.8.2 , is susceptible to an authorization vulnerability. The root cause is a lack of object-level authorization checks on one of its workflow REST routes (specifically workflows/run). This flaw allows users with the Contributo...

CVE-2026-92411: Improper Neutralization of Input During Web Page Generation

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

PT-2026-99247

Name of the Vulnerable Software and Affected Versions WP Delicious WordPress plugin versions prior to 1.10.8 Description Insufficient validation and escaping of HTML tag names derived from user-supplied recipe block data allows users with the Contributor role and above to inject arbitrary HTML...

CVE-2026-96525: Missing Authorization

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow create, update and delete REST routes, allowing users with the Contributor role to modify, delete and create site-wide workflow configuration, including workflow...

PT-2026-99249

Name of the Vulnerable Software and Affected Versions MCP Server for WordPress versions prior to 1.8.2 Description The plugin fails to perform ownership or sufficient capability checks on its REST routes used to create, update, and delete workflows. This allows users with the Contributor role to...

CVE-2026-96526: Exposure of Sensitive Information to an Unauthorized Actor

The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users'...

CVE-2026-92746

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92829

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.1.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-78394

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...