EUVD-2026-114650

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

EUVD-2026-114652

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

EUVD-2026-114646

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

EUVD-2025-211229

The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.5.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

EUVD-2026-114610

The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbsactionajaxcalendarremovenote function in versions up to, and including, 2.1.0.5 This makes it possible for authenticated attackers, with...

EUVD-2026-114600

The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'degreetitle' parameter in all versions up to, and including, 2.7.0 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-114602

The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website userurl field. This is due to insufficient output escaping in the ctdbfiltercommentauthorname callback hooked to...

CVE-2026-107711

The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products.postcontent' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-96554

The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and abov...

WordPress BuddyBoss Platform plugin <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Buddyboss Platform versions = 3.6.0...

CVE-2026-101325

The Newsletters plugin for WordPress (versions up to and including 4.18.1 ) is vulnerable to a time-based SQL Injection via the 'id' parameter . The root cause is insufficient escaping of user-supplied input and a lack of proper query preparation. This allows authenticated attackers with subscrib...

CVE-2026-101325 Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-119160 Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This...

WordPress Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Iron StrongMan in WordPress Plugin Ninja Forms versions = 3.15.5...

CVE-2026-116535

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname' parameter in all versions up to, and including, 10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-111592

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

CVE-2025-9462

The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.5.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-103997

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.15. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by mamgad mamgad in WordPress Plugin GeoDirectory versions = 2.8.197...

WordPress Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Jacek Sowiński dzaku in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions = 4.0.9...