CVE-2026-66644 WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66641 WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...

CVE-2026-66627

The WordPress GP Premium plugin (versions ≤ 2.5.5) allows contributors to upload arbitrary files, enabling potential remote code execution, data theft, or site defacement. CVSS 9.9 (Critical) reflects network-accessible, low-complexity exploitation with low privileges required. Update to the late...

CVE-2026-66621 WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MapSteps UG Ultimate Dashboard Pro allows DOM-Based XSS. This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2...

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

EUVD-2026-60901

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

CVE-2026-32463 WordPress Sync Post With Other Site plugin <= 1.9.3 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

EUVD-2026-60893

Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...

CVE-2026-28192

The Piotnet Addons For Elementor Pro WordPress plugin (versions ≤ 7.1.67) allows unauthenticated arbitrary file upload, enabling remote code execution with CVSS 9.6 (Critical). Patchstack assigned PT-2026-77033; CISA SSVC rates technical impact as total with no known exploitation yet. Upgrade bey...

CVE-2026-28192 WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.67 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Contact Form by Supsystic versions 1.10.0...

WordPress URL Shortify plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin URL Shortify versions = 2.5.0...

WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Typing Effect versions = 1.3.7...

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Tab Widget versions = 1.2.11...

WordPress Link Library plugin <= 7.9.4 - Unauthenticated Arbitrary File Deletion via link_url Parameter vulnerability

Unauthenticated Arbitrary File Deletion via linkurl Parameter vulnerability discovered by nudien in WordPress Plugin Link Library versions = 7.9.4...

PT-2026-77088

Unauthenticated Remote Code Execution RCE in WP Compress 7.20.01 versions...

PT-2026-77067

Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...

PT-2026-77107

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Subscribe2 versions = 10.46...

CVE-2026-74997

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmdlearn driver...