Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

CVE-2026-88997

CVE-2026-88997 JSM Show Post Metadata 4.9.1 — 贡献者及以上权限通过自定义字段元键存储型 XSS | ---|--- CVE ID| CVE-2026-88997 状态| 已发布 CNA| WPScan 发布日期| 2026-09-23 更新日期| 2026-09-23 CWE| CWE-79: 跨站脚本（XSS） 描述 JSM Show Post Metadata WordPress 插件在 4.9.1 之前的版本中，在将文章元键输出到面向管理员的元框中的内联事件处理程序属性之前，未对其进行正确转义。这允许具有贡献者级别及以上权限 的用户注入...

CVE-2026-2600-POC

CVE-2026-2600 ElementsKit Elementor 插件 $item echo '' . $item'ekittabtitle' . ''; Elementor 编辑器会在客户端对输入进行清理，但 REST API 端点（/wp-json/wp/v2/posts/id）会直接接受 elementordata 元字段，完全绕过了这一层防护。 已认证的贡献者可以通过 PATCH 请求修改文章，注入精心构造的 Elementor JSON 载荷，将 ekittabtitle 设置为任意 HTML。由于该值会原样存储在 elementordata 中，并在渲染时未经...

CVE-2026-28134

CVE-2026-28134 漏洞利用报告 JetEngine = 3.7.2 — 通过 Twig SSTI 实现已认证（Contributor+）远程代码执行 日期： 2026 年 3 月 11 日 CVSS 评分： 8.8（高危） CVSS 向量： CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 受影响插件： JetEngine = 3.7.2 插件 Slug： jet-engine CVE： CVE-2026-28134 状态： 私有 测试的 WordPress 版本： 最新版 执行摘要 CVE-2026-28134 是 JetEngine...

CVE-2021-42362

CVE-2021-42362 WordPress Popular Posts插件存在任意文件上传漏洞，原因是位于/src/Image.php文件中的输入文件类型验证不足，这使得具有贡献者级别及以上权限的攻击者可以上传恶意文件，从而获得远程代码执行。...

CVE-2026-104646

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

CVE-2026-104645

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

EUVD-2026-94763

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

CVE-2026-104646 Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

EUVD-2026-94764

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject...

PT-2026-107830

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any...

GHSA-4PVX-FWJJ-8GPC Ghost: Editors Could Promote Staff Users to Their Own Role

Impact Staff users with the Editor or Super Editor role were able to assign their own role to Author and Contributor users, despite not having permission to assign that role. Vulnerable versions This vulnerability is present in Ghost from v0.5.0 up to v6.64.0. Patches v6.64.0 contains a fix for...

CVE-2026-97354

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...

CVE-2026-97354 PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...

CVE-2026-97354

The PowerPress Podcasting plugin by Blubrry for WordPress (versions 11.13.12 - 11.17.10 ) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a failure to validate the destination of redirects when the plugin fetches a user-supplied media URL. This allows users with contributo...

EUVD-2026-94192

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...

CVE-2026-97354 PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL Redirects

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a user-supplied media URL, allowing users with the contributor role and above to perform Server-Side Request Forgery attacks against internal services...

WordPress PowerPress Podcasting plugin by Blubrry plugin 11.13.12-11.17.10 - Contributor+ SSRF vulnerability

Contributor+ SSRF vulnerability discovered by Raj Ukani in WordPress Plugin PowerPress Podcasting versions 11.13.12-11.17.10...

WordPress CP Media Player plugin < 1.3.4 - Contributor+ Media Player Settings Update vulnerability

Contributor+ Media Player Settings Update vulnerability discovered by Ryan Fabella in WordPress Plugin CP Media Player versions 1.3.4...

WordPress Core <6.5.2 - Cross-Site Scripting

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. id: CVE-2024-4439 info: name: WordPress Core 6.5.2 - Cross-Site Scripting author: nqdung2002 severity: hi...