CVE-2026-1646

CVE-2026-1646 affects the Advance Block Extend WordPress plugin (versions up to and including 1.0.4). The issue is a Stored Cross-Site Scripting (XSS) in the TitleColor attribute of the Latest Posts Gutenberg block, caused by insufficient input sanitization and output escaping. Exploitation requi...

PT-2026-20638

Name of the Vulnerable Software and Affected Versions Advance Block Extend plugin for WordPress versions through 1.0.4 Description The Advance Block Extend plugin for WordPress has a Stored Cross-Site Scripting issue. This is due to insufficient input sanitization and output escaping in the...

PT-2026-20607

The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $ REQUEST'post id' parameter without verification in the...

CVE-2026-1646: Improper Neutralization of Input During Web Page Generation

The Advance Block Extend plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TitleColor block attribute in the Latest Posts Gutenberg block in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress plugin Endless Posts Navigation 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-20700

Missing Authorization vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Endless Posts Navigation: from n/a through = 2.2.9...

CVE-2026-1219: Authorization Bypass Through User-Controlled Key

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'loadtracknoteajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers...

PT-2026-20776

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load track note ajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated...

CVE-2026-25332: Missing Authorization

Missing Authorization vulnerability in Fahad Mahmood Endless Posts Navigation endless-posts-navigation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Endless Posts Navigation: from n/a through = 2.2.9...

CVE-2025-70147

creationtimestamp| type| source ---|---|--- 2026-02-18 19:37:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5tcjlz5b2s 2026-02-18 19:37:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5tdgzstj2n...

CVE-2025-70148

creationtimestamp| type| source ---|---|--- 2026-02-18 18:32:13+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mf5pnyqhuz2h 2026-02-18 19:00:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5rahomoq2k...

CVE-2026-2507

creationtimestamp| type| source ---|---|--- 2026-02-18 17:23:26+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5lt2ytbd25 2026-02-18 17:23:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5ltgkt3r2c 2026-02-18 17:24:19+00:00| seen|...

CVE-2025-60035

creationtimestamp| type| source ---|---|--- 2026-02-18 14:18:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5biceh3r2n 2026-02-18 14:18:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5bj4fgfo2d 2026-02-19 05:00:00+00:00| seen|...

CVE-2025-33253

creationtimestamp| type| source ---|---|--- 2026-02-18 14:18:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5bi3a7bc2s 2026-02-18 14:18:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5biuzxew25...

CVE-2025-33252

creationtimestamp| type| source ---|---|--- 2026-02-18 14:18:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5bhtpgd72s 2026-02-18 14:18:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mf5bio2fvx2s...

CVE-2026-2386

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpaecreatepage AJAX handler authorizing users only with...

CVE-2026-2386 The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpaecreatepage AJAX handler authorizing users only with...

CVE-2026-2386

The Plus Addons for Elementor vulnerability (CVE-2026-2386) affects WordPress plugin The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce. It relies on tpae_create_page() AJAX handler which authorizes only current_user_can('edit_posts') but passes ...

CVE-2026-2386 The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 6.4.7. This is due to the tpaecreatepage AJAX handler authorizing users only with...

CVE-2026-2126

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 20260113. This is due to the uspgetsubmittedcategory function accepting user-submitted category IDs from the POST body...