EUVD-2026-112617

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

CVE-2026-78396 Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure

The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set...

EUVD-2026-112613

The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set...

CVE-2026-115302 Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries...

CVE-2026-78396

The Link Library WordPress plugin, in versions prior to 7.10.0 , is vulnerable to unauthenticated information disclosure. The root cause is a lack of verification that a requested link belongs to the specific settings set used for the display template. This allows attackers to access and disclose...

CVE-2026-115282 Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and...

WordPress Contact Form by Supsystic plugin < 1.11.1 - Arbitrary Plugin Settings Update vulnerability

Arbitrary Plugin Settings Update vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Contact Form by Supsystic versions 1.11.1...

CVE-2026-115282

The Recipe Card Blocks Lite WordPress plugin (versions 2.6.4-3.6.3 ) is vulnerable to an unauthenticated unpublished post content disclosure due to a missing authorization check. The flaw exists within the recipe print feature , which allows attackers to view the title, ID, and content of unpubli...

CVE-2026-115282 Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and...

Joomla-webshell-plugin

Joomla webshell plugin for RCE A webshell plugin and interactive shell for pentesting a Joomla website. Features Webshell plugin for Joomla. Execute system commands via an API with ?action=exec. Download files from the remote system to your attacking machine with ?action=download. Usage...

Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting

Moodle Jitsi Meet 2.7 through 2.8.3 plugin contains a cross-site scripting vulnerability via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject JavaScript code to be run by the application. id: CVE-2021-26812 info: name: Moodle...

CVE-2026-113387

The Ortto plugin for WordPress (versions prior to 1.0.25 ) is vulnerable to an authentication bypass. The plugin fails to properly authenticate configuration update requests, relying instead on a secret that is exposed in public HTML. An unauthenticated threat actor can exploit this flaw to overw...

CVE-2026-113387

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...

CVE-2026-113387

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts...

EUVD-2026-112505

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an authenticated user who can post in a channel visible to a system administrator to cause the administrator's browser to send...

PT-2026-132273

Unauthenticated Cross Site Scripting XSS in Razorpay Payment Button Elementor Plugin = 1.2.8 versions...

CVE-2026-108685: Unknown WP Post Author: The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its…

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator...

WordPress Extra Fees Plugin for WooCommerce deserialization injection vulnerability

WordPress Extra Fees Plugin for WooCommerce versions 4.4.0 and earlier contain a deserialization injection vulnerability, which stems from PHP object injection...

VulnCheck KEV: CVE-2024-10441

Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS BSM before 1.1-65374 and Synology DiskStation Manager DSM before 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 allows remote attackers to execute arbitrary code via unspecified vectors...

PT-2026-130641

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site...