CVE-2026-95587

Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...

CVE-2026-95587 WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...

CVE-2026-95587 WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...

CVE-2026-95587

The WordPress Hostinger Migrator plugin (version

EUVD-2026-89854

Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...

CVE-2026-87777

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

WordPress Hostinger Reach plugin 1.0.6-1.8.2 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Hostinger Reach AI-Powered Email Marketing for WordPress versions 1.0.6-1.8.2...

EUVD-2026-89628

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

CVE-2026-87777 Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

CVE-2026-87777

The Hostinger Reach WordPress plugin (versions 1.0.6 through 1.8.2) is vulnerable to Stored XSS because it fails to sanitize and escape a widget setting before outputting it in the editor preview. This flaw specifically involves the formId Elementor Widget Attribute . An attacker with contributor...

CVE-2026-87777 Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

CVE-2026-95587: Missing Authorization

Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...

CVE-2026-87777: Improper Neutralization of Input During Web Page Generation

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

PT-2026-103186

Unauthenticated Broken Access Control in Hostinger Migrator = 1.0 versions...

PT-2026-103033

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by onecomputerguy in WordPress Plugin Hostinger Migrator versions = 1.0...

WordPress Hostinger Tools - Full Path Disclosure Detection

WordPress Plugin Hostinger Tools files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Hostinger Tools files are publicly accessible...

CVE-2026-2515

The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handleajaxaction' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated...

CVE-2026-2515

The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handleajaxaction' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated...

EUVD-2026-29918

The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handleajaxaction' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated...