CVE-2026-85658 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an actio...

EUVD-2026-83554

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is due to the software allowing users to execute an actio...

CVE-2026-13200

The Create plugin for WordPress (by Mediavine) is vulnerable to generic SQL injection via the 'order' parameter in all versions up to and including 2.5.3 . The root cause is insufficient escaping and inadequate preparation of the SQL query. The vulnerable code path in the advanced-filter branch i...

CVE-2026-1641

The Wow Elements Addons for Elementor plugin for WordPress is affected by a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.11.2 . The root cause is the plugin passing user-controlled input from the 'Changelog File' setting directly to the wp_remote_get func...

CVE-2026-4327

The The Welcomizer WordPress plugin is vulnerable to Remote Code Execution in all versions up to and including 2.8.1 . The root cause is a missing current_user_can() capability check on the twiz_ajax_callback AJAX action's savesection handler, combined with the use of eval() to execute user-suppl...

EUVD-2026-83548

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twizajaxcallback AJAX action's 'savesection' handler combined with the use of eval to execute user-supplied 'custom logic'...

EUVD-2026-83547

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset...

CVE-2026-13770 AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler

The AppMySite – WordPress & WooCommerce Mobile App Builder No-Code Android & iOS App Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping...

EUVD-2026-83542

The AppMySite – WordPress & WooCommerce Mobile App Builder No-Code Android & iOS App Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping...

CVE-2026-15947

The Metasync plugin for WordPress (also referenced as Search Atlas SEO ) is vulnerable to unauthorized data modification in versions up to and including 2.6.23 . The root cause is a missing capability check on the save_instant_indexing_settings() function registered on the admin_init hook, which ...

CVE-2026-11899

PDF Builder for WooCommerce – Create invoices, packing slips and more is a WordPress plugin vulnerable to authorization bypass in all versions up to and including 2.0.11 . The flaw exists in the GetInvoiceDetail AJAX handler (woocommerce-pdf-invoice-ajax.php), where the plugin fails to properly v...

EUVD-2026-83515

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete...

EUVD-2026-83503

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-15760

The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxtegetdatabasetables and dnxtegetdatabasedata AJAX actions. The handlers only conditionally verify a nonce the check runs solely when the 'nonce' POST paramete...

CVE-2026-12042 WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress (versions up to and including 2.4.12 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'pages' parameter in admin settings, caused by insufficient input sanitization and output escaping. An authenticated attacker with administrator-level ...

CVE-2026-88944

CVE-2026-88944 is an authorization bypass in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8 ). The plugin fails to properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access or above to permanently delete a...

EUVD-2026-83475

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-77820

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-83465

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...