WP Ticket <= 6.0.4 - SQL Injection

WP Ticket wp-ticket for WordPress through 6.0.4 allows unauthenticated SQL injection via front-end search due to unsanitized use of the "s" parameter in emdauthorsearchresults. Exploitation requires at least one guest ticket. Fixed in 6.0.5. id: CVE-2026-9848 info: name: WP Ticket = 6.0.4 - SQL...

CVE-2026-109367

The All in One SEO WordPress plugin (versions up to and including 5.0.3 ) is vulnerable to Sensitive Information Exposure via the 's' search query parameter . This flaw allows unauthenticated attackers to extract non-public post meta values, such as API keys and internal notes , which are emitted...

EUVD-2026-114673

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers...

CVE-2026-109367 All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers...

CVE-2026-109367: smub: The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin…

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers...

WordPress All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter vulnerability

Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter vulnerability discovered by Santh in WordPress Plugin All In One SEO Pack versions = 5.0.3...

CVE-2026-102905 Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter

The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...

CVE-2026-102905 Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter

The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...

CVE-2026-102905

The Ad Inserter plugin for WordPress (all versions up to and including 2.8.19 ) is vulnerable to unauthenticated arbitrary shortcode execution via the 's' search parameter . The root cause is the software's failure to properly validate a value before executing the do_shortcode function. This allo...

CVE-2026-103911 Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-103911 Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2026-104769

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

CVE-2026-104769

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.3.0 . The flaw exists in the 's' parameter and allows an unauthenticated visitor to read arbitrary files on the server, potentially exposing sensitive infor...

CVE-2026-104769 Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

EUVD-2026-102616

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

CVE-2026-104769: Improper Limitation of a Pathname to a Restricted Directory

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...

WordPress Debloat – Remove unused CSS, optimize JS path traversal vulnerabilities

WordPress Debloat – Remove unused CSS and optimize JS versions 1.3.0 and earlier. Version 1.3.0 and earlier have a path traversal vulnerability due to improper handling of the parameter “s”. This vulnerability allows for directory traversal attacks, potentially enabling authenticated attackers wi...

VulnCheck KEV: CVE-2025-12197

The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticat...

CVE-2026-89417 OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-100152 All in One SEO <= 5.0.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...