WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability

WordPress Universal Video Player - Addon for WPBakery Page Builder = 3.2.1 - Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Universal Video Player - Addon for WPBakery Page Builder versions = 3.2.1...

WordPress Webba Booking <= 5.1.20 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Hiro Code016Hiro in WordPress Plugin Webba Booking versions = 5.1.20...

WordPress DB Backup <= 6.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by 0xd4rk5id3 in WordPress Plugin DB Backup versions = 6.0...

WordPress Youtube Vimeo Video Player and Slider <= 3.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Youtube Vimeo Video Player and Slider versions = 3.8...

WordPress Radio Player Shoutcast & Icecast <= 4.4.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Radio Player Shoutcast & Icecast versions = 4.4.7...

WordPress Ultimate WP Mail plugin 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function vulnerability

WordPress Ultimate WP Mail plugin 1.0.17 - 1.3.6 - Missing Authorization to Authenticated Contributor+ Privilege Escalation via getemaillogdetails Function vulnerability discovered by kr0d in WordPress Plugin Ultimate WP Mail versions 1.0.17 - 1.3.6...

WordPress ProfileGrid plugin <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function vulnerability

Reflected Cross-Site Scripting via 'pmgetmessengernotification' function vulnerability discovered by Kenneth Billones Kenziy in WordPress Plugin ProfileGrid versions = 5.9.5.4...

WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin Product XML Feed Manager for WooCommerce versions = 2.9.2...

WordPress Contest Gallery <= 26.0.6 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by domiee13 in WordPress Plugin Contest Gallery versions = 26.0.6...

WordPress Broken Link Notifier plugin <= 1.3.0 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Broken Link Notifier versions = 1.3.0...

WordPress Hostel plugin < 1.1.5.8 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Tommaso Gregori p1s1o in WordPress Plugin Hostel versions 1.1.5.8...

WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Wishlist for WooCommerce versions = 3.2.3...

WordPress WP Lightbox 2 plugin < 3.0.6.8 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin WP Lightbox 2 versions 3.0.6.8...

WordPress WP File Download plugin < 6.2.6 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Kevin Camus in WordPress Plugin WP File Download versions 6.2.6...

WordPress Gwolle Guestbook plugin <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via gwollegbcontent Parameter vulnerability discovered by zer0gh0st in WordPress Plugin Gwolle Guestbook versions = 4.9.2...

WordPress wpForo Forum plugin <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via Profile Avatar vulnerability discovered by Muhan Luo in WordPress Plugin wpForo Forum versions = 2.4.5...

July Security Advisory Ivanti Connect Secure and Ivanti Policy Secure (Multiple CVEs)

Last Modified Date Aug 23, 2026 10:37:33 PM...

WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by astra.r3verii Patchstack Alliance in WordPress Plugin Internal Linking of Related Contents versions = 1.1.8...

WordPress AI Engine plugin <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via mwaichatbot Shortcode id Parameter vulnerability discovered by mikemyers in WordPress Plugin AI Engine versions = 2.8.4...

WordPress WP Human Resource Management plugin 2.0.0-2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Employee+ Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin WP Human Resource Management versions 2.0.0-2.2.17...