CVE-2026-17602

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

CVE-2026-13179

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-12037

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-12037 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

EUVD-2026-86575

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

CVE-2026-12037

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 1.4.0.5 . The vulnerability exists via the 'page_url' parameter and is only exploitable when an administrator has configured the plugin's dom_get_type...

CVE-2026-12037 Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Authenticated (Administrator+) Server-Side Request Forgery via 'page_url' Parameter

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.4.0.5 via the 'pageurl' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

EUVD-2026-86600

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-13179

The WP Maps plugin for WordPress (versions up to and including 4.9.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the shapes_values parameter. The root cause is insufficient input sanitization and output escaping . Authenticated attackers with subscriber-level access or higher can inj...

CVE-2026-13179 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-13179 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shapesvalues Parameter in all versions up to, and including, 4.9.8 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-17602 SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

CVE-2026-17602

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to a Directory Traversal (Path Traversal) vulnerability in all versions up to and including 4.7.42 . The root cause is a flaw in handling the 'file_name' parameter. This allows authenticated attackers wit...

CVE-2026-17602 SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

EUVD-2026-86599

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

EUVD-2026-86595

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-13456 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-93656

The User Profile Builder plugin for WordPress (versions up to and including 4.0.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Avatar Field . The root cause is insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can i...

CVE-2026-13456

The WP Maps WordPress plugin (versions up to and including 4.9.8 ) is vulnerable to Local File Inclusion (LFI) via the 'page' parameter . Authenticated attackers with subscriber-level access or higher can include and execute arbitrary .php files on the server. This flaw may lead to bypassing acce...

EUVD-2026-86596

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...