CVE-2026-116761 CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-116761

The CMB2 plugin for WordPress (versions up to and including 2.13.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the cmb43ex1_grp[0][txt] parameter, which corresponds to a WYSIWYG field inside a repeatable group...

EUVD-2026-111602

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1grp0txt wysiwyg field inside group — field id controlled by integrator config' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-94267

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

CVE-2026-94267

The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins, in versions prior to 0.9.2.8 , are vulnerable to unauthenticated Remote Code Execution (RCE) . The root cause is a lack of capability checks when updating a post via front-end form actions. An unauthe...

CVE-2026-94267 Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

EUVD-2026-108604

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

CVE-2026-94267 Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

PT-2026-121777

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary...

CVE-2026-12526

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-12526

The Advanced Custom Fields: Extended WordPress plugin (versions before 0.9.2.7 ) contains an unauthenticated administrator account takeover vulnerability in its front-end Forms module . The root cause is a failure to verify if a requester is authorized to edit the targeted user account during the...

EUVD-2026-69871

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

CVE-2026-12526 Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or superadmin. On a...

WordPress Link Library plugin < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form vulnerability

Unauthenticated SQL Injection via the Front-End Link Submission Form vulnerability discovered by Abdullah Kareem cyberkareem in WordPress Plugin Link Library versions 7.9.3...

CVE-2026-16532 Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-8382 Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

The Advanced Custom Fields ACF® plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrit...

CVE-2026-8382 Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters

The Advanced Custom Fields ACF® plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrit...

CVE-2016-15042: Unrestricted Upload of File with Dangerous Type

The Frontend File Manager versions 4.0, N-Media Post Front-end Form versions 1.1 plugins for WordPress are vulnerable to arbitrary file uploads due to missing file type validation via the nmfilemanageruploadfile and nmpostfrontuploadfile AJAX actions. This makes it possible for unauthenticated...

PT-2024-10575 · Unknown · N-Media Post Front-End Form +1

Name of the Vulnerable Software and Affected Versions: Frontend File Manager versions prior to 4.0 N-Media Post Front-end Form versions prior to 1.1 Description: The issue allows unauthenticated attackers to upload arbitrary files on the server due to missing file type validation via the nm...