CVE-2026-62131 WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Zoho Flow = 2.14.5 versions...

EUVD-2026-112955

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

CVE-2026-54866 WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

CVE-2026-54866

The Razorpay Payment Button Elementor Plugin for WordPress, in versions

CVE-2026-54866 WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

CVE-2026-80067

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

CVE-2026-80069

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mj404error in WordPress Plugin Page Restriction WordPress WP versions = 1.6.1...

WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Flash & HTML5 Video versions = 2.14.0...

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Media LIbrary Assistant versions = 3.42...

CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

EUVD-2026-112859

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

CVE-2026-80067 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

EUVD-2026-112926

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Content Injection vulnerability discovered by Peter Tang in WordPress Plugin Brave versions = 0.8.8...

WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Site Reviews versions = 8.3.5...

Cross-site Scripting (XSS)

TinyMCE is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to processing elements created through data-mce-object in the active document before sanitization, which allows an attacker to inject malicious scripts that execute during media processing and cause stored XSS in...

CVE-2026-96767

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-96767

The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 9.3.2 . The root cause is insufficient input sanitization and output escaping related to the 'type' parameter . This flaw allows unauthenticated attackers to ...

EUVD-2026-112745

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...