WordPress Customer Engagement System plugin < 2.0.2 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Popup by Supsystic versions 2.0.2...

CVE-2026-113494

The GeoDirectory WordPress plugin, in versions prior to 2.8.195 , contains a vulnerability where it fails to perform status or ownership checks when rendering a listing referenced by an id attribute within its field shortcodes. This flaw allows authenticated users with the Contributor role or hig...

CVE-2026-113488 GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...

CVE-2026-113488 GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...

CVE-2026-113494 GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode

The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft,...

CVE-2026-111960

The Royal MCP WordPress plugin before version 1.5.10 contains a vulnerability where it fails to perform proper object-level or post-type authorisation checks within one of its search tools. This flaw allows authenticated users, such as those with subscriber privileges, to disclose the titles and ...

CVE-2026-111960 Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal M...

EUVD-2026-111720

The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal M...

EUVD-2026-111721

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without...

CVE-2026-111961 Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without...

EUVD-2026-111715

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is trick...

EUVD-2026-111719

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the GoSMTP WordPress plugin before 1.2.5-activation capability, allowing users with a delegated role below administrator to change outbound ma...

CVE-2026-111032

The Welcart e-Commerce WordPress plugin (versions before 2.12.6 ) is vulnerable to an incorrect authorization flaw because capability checks are not tied to the specific product being edited. This allows any authenticated user with Author-level access or higher to read, modify, create, delete, an...

CVE-2026-111032 Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read...

EUVD-2026-111717

The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect users to arbitrary external websites...

CVE-2026-111032 Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax

The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against the targeted product before processing SKU changes, because its capability check is not tied to the product being edited, allowing any authenticated user with Author-level access or higher to read...

CVE-2026-110691 WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the logi...

CVE-2026-110691 WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the logi...

CVE-2026-110691

The WPOrLogin WordPress plugin (versions before 3.1.0 ) is vulnerable to an unauthenticated hide login slug update vulnerability. The root cause is a failure to perform a capability check or nonce validation when updating the plugin's hidden-login URL settings. An unauthenticated attacker could e...

CVE-2026-110506 Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against...