CVE-2026-14289

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file...

EUVD-2026-49079

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...

CVE-2026-14190 Sina Extension for Elementor < 3.10.2 - Reflected XSS

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

CVE-2026-14189

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...

EUVD-2026-49075

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request...

EUVD-2026-49077

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

CVE-2026-14203

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-13726

CVE-2026-13726 affects the MPG WordPress plugin prior to version 4.1.8. The vulnerability stems from inadequate sanitisation/escaping of a parameter that is reflected back in the response, enabling unauthenticated attackers to perform Reflected Cross‑Site Scripting when a victim is coaxed into se...

CVE-2026-14190

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

CVE-2026-13726 Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request...

CVE-2026-14190

CVE-2026-14190 concerns the Sina Extension for Elementor WordPress plugin (before 3.10.2). An unauthenticated AJAX handler reflects a value reconstructed from request input into the HTML response without escaping, enabling reflected XSS : unauthenticated attackers can trigger a crafted request to...

CVE-2026-14235

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...

EUVD-2026-49076

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search...

CVE-2026-14189

The CVE covers the WPBot WordPress plugin prior to version 8.5.2. The root cause is failure to validate administrator-configured field identifiers before they are used in a SQL query, enabling a second-order SQL injection when a visitor triggers a search. The vulnerability can be exploited by use...

CVE-2026-13726

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request...

CVE-2026-14203

CVE-2026-14203 affects the Smart Manager WordPress plugin prior to version 8.92.0. The vulnerability is a failure to properly encode a post field when rendering it into an HTML attribute in the management grid, allowing users with the Contributor role or higher to inject JavaScript that executes ...

CVE-2026-14203 Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the...

CVE-2026-13714

The CVE-2026-13714 entry concerns Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin (before 5.3.0). The issue is a lack of validation of uploaded file types, with file uploads gated only by an API that is enabled by default and authenticated using hardcoded credentials shipped across...

CVE-2026-13597

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

CVE-2026-13714 Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all...