WordPress Themify Builder < 7.5.8 - Open Redirect

The Themify Builder WordPress plugin before version 7.5.8 contains an open redirect vulnerability. The plugin does not validate the tbredirectfail parameter before redirecting users to its value, which could allow attackers to redirect users to malicious websites. id: CVE-2024-3032 info: name:...

Giga Messenger WordPress - Cross-Site Scripting

Giga Messenger WordPress plugin = 2.3.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

CVE-2026-17022

The CVE-2026-17022 affects the Salon Booking System WordPress plugin (

EUVD-2026-55011

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

Export WP Page to Static HTML <= 4.3.4 - Cookie Exposure

Export WP Page to Static HTML & PDF WordPress plugin = 4.3.4 contains a sensitive information exposure caused by publicly exposed cookies.txt files with authentication cookies, letting unauthenticated attackers access sensitive authentication data, exploit requires site administrator to trigger...

CVE-2026-16590

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users...

CVE-2026-15359

Templately WordPress plugin

CVE-2026-14936 Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership, allowing unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayP...

CVE-2026-10599 Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid...

CVE-2026-66696 WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...

CVE-2026-66694

The CVE-2026-66694 entry concerns an Unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress Thrive Architect plugin (versions up to and including 10.9.3.1). The connected documents consistently describe a client-side/server-side XSS condition in Thrive Architect, without...

CVE-2026-66685 WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-65554

The CVE-2026-65554 entry concerns the WordPress AnsPress – Question and Answer plugin version 4.4.4, with a Broken Access Control vulnerability affecting subscribers. The available connected sources confirm the affected software and the underlying issue as access control in the plugin’s subscribe...

CVE-2026-28146 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...

CVE-2026-14314

The CVE concerns the PeproDev WooCommerce Receipt Uploader WordPress plugin (≤ v2.8.0). The root cause is a failure to verify that a requested attachment belongs to the order referenced by its access token, enabling an unauthenticated attacker to forge a token and disclose image attachments, incl...

CVE-2026-70436

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check 1.4.0 and earlier or performs an improper permission check 1.4.1 when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to...

CVE-2026-70441

Summary: CVE-2026-70441 affects Jenkins’ Summary Display Plugin v1.15 and earlier. The root cause is failure to escape the job name in a JavaScript context on build report pages, enabling a stored XSS vulnerability. Impact/conditions: exploit requires Item/Create or Item/Configure permissions; th...

CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

EUVD-2026-53119

The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator...

WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Total Upkeep versions = 1.17.2...