CVE-2026-94124: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in WP EasyCart = 5.9.4 versions...

CVE-2026-6831: Missing Authorization

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-91077: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-93507: Missing Authorization

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-85006: Improper Neutralization of Input During Web Page Generation

The HappyAddons for Elementor WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser o...

PT-2026-97336

Name of the Vulnerable Software and Affected Versions WPGraphQL versions prior to 2.22.2 Description An authorization bypass exists in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The system only verifies the collection-level edit posts capability and the post author, failing...

PT-2026-97458

Name of the Vulnerable Software and Affected Versions Premium Addons for Elementor versions prior to 4.11.106 Description Cross Site Scripting XSS allows an attacker with contributor-level permissions to execute malicious scripts in the browser of other users. Recommendations Update Premium Addon...

WordPress Advanced Contact form 7 DB plugin <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure vulnerability

Missing Authorization to Authenticated Contributor+ Information Disclosure vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Advanced Contact form 7 DB versions = 2.1.1...

CVE-2026-9231 WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-16778

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslcmoduledownloadsoutput' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-12995

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2026-9004 WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-9004 WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.4.6 . The root cause is a flaw in the 'contact_id' parameter, which allows authenticated attackers with contributor-level access or higher to ...

CVE-2026-16778

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.21 . The flaw exists in the 'dslc_module_downloads_output' shortcode content due to insufficient input sanitization and output escapin...

EUVD-2026-84298

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslcmoduledownloadsoutput' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible fo...

EUVD-2026-84297

The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the editmetavalue due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access...

CVE-2026-16778 Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslcmoduledownloadsoutput' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-16778 Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslcmoduledownloadsoutput' Shortcode Content in all versions up to, and including, 2.1.21 due to insufficient input sanitization and output escaping. This makes it possible fo...