WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by nh4tvd in WordPress Plugin NEX-Forms versions = 9.3.2...

poc-forge

PoC-Forge ⚠️ This is a vulnerability verification framewo...

CVE-2026-78396

The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set...

CVE-2026-89216

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database...

CVE-2026-110505

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...

CVE-2026-105258

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

CVE-2026-115245 Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution...

CVE-2026-115245

The Chat AI with Dispatcher WordPress plugin (versions before 2.4 ) contains an unauthenticated arbitrary file upload vulnerability. The root cause is insufficient validation of uploaded files, as the plugin relies on a spoofable client-supplied content type. This allows an attacker to upload arb...

EUVD-2026-112632

The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and does not escape several of the submitted values before outputting them in the administration dashboard and on the public calendar, allowing unauthenticated...

CVE-2026-115245 Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution...

CVE-2026-114270 GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...

CVE-2026-110983

The WP Photo Album Plus WordPress plugin (versions before 9.3.04.004 ) is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The software fails to verify the origin or a security token for specific comment-management requests. An attacker can exploit this by tricking a logged-in user with co...

CVE-2026-111739 Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter

The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security AIOS WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own...

CVE-2026-114270 GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure

The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password...

EUVD-2026-112622

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-112623

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...

WordPress Enable SVG, WebP, and ICO Upload plugin 1.1.3-1.1.5 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Shyu Yang in WordPress Plugin Enable SVG, WebP & ICO Upload versions 1.1.3-1.1.5...

WordPress Enable SVG, WebP, and ICO Upload plugin < 1.1.6 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Enable SVG, WebP & ICO Upload versions 1.1.6...

CVE-2026-108685 WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

CVE-2026-108763

The Wallet System for WooCommerce WordPress plugin, in versions before 2.8.2 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The KYC document submission handler fails to perform ownership or capability checks, allowing it to accept a target user ID from a client-supplied reque...