CVE-2026-84066 Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.9 - Subscriber+ Arbitrary Post Meta Write vulnerability

Subscriber+ Arbitrary Post Meta Write vulnerability discovered by ryan zegar in WordPress Plugin Directorist versions 8.9...

WordPress CubeWP plugin <= 1.1.31 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin CubeWP versions = 1.1.31...

WordPress Slim SEO plugin < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure vulnerability

Contributor+ Arbitrary Post Meta Disclosure vulnerability discovered by Shivamani Vastrala in WordPress Plugin Slim SEO versions 4.9.11...

CVE-2026-13404 Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-13404

CVE-2026-13404 affects the Royal Addons for Elementor WordPress plugin in versions prior to 1.7.1066 . The vulnerable function wpr_likes_init does not perform any capability or ownership check, relying solely on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta ...

EUVD-2026-66266

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

EUVD-2026-64299

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-4561 MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form response message post meta fields e.g., 'textsubscribed', 'texterror' in all versions up to, and including, 4.12.0 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-4561

The MC4WP: Mailchimp for WordPress plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 4.12.0 . The flaw resides in the form response message post meta fields (e.g., text_subscribed, text_error), caused by insufficient input sa...

WordPress Saitama Addon Pack plugin <= 1.0.8 - Contributor+ Stored XSS via Post Meta vulnerability

Contributor+ Stored XSS via Post Meta vulnerability discovered by testoun in WordPress Plugin Saitama Addon Pack versions = 1.0.8...

CVE-2026-16979 SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration

The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...

WordPress Toocheke Companion plugin <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'seriesbgcolor' Post Meta vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Toocheke Companion versions = 2.10...

CVE-2026-2497

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-59925

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-15604

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...

CVE-2026-19613 ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...

CVE-2026-15604 Toocheke Companion <= 2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'series_bg_color' Post Meta

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...

CVE-2026-15604

The CVE-2026-15604 entry concerns the Toocheke Companion WordPress plugin. It describes a Stored Cross-Site Scripting (Stored XSS) flaw in versions up to 2.10, caused by insufficient input sanitization in toocheke_series_bg_color_save() (stores raw $_POST in post meta) and inadequate output escap...