CVE-2026-48870: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in King Addons for Elementor = 51.1.62 versions...

CVE-2026-42659: Missing Authorization

Subscriber Broken Access Control in Advanced Form Integration = 1.126.12 versions...

CVE-2026-42378: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in WP Full Stripe Free = 8.4.1 versions...

CVE-2026-40796: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Subscriber Sensitive Data Exposure in WPPizza = 3.19.9 versions...

CVE-2026-40773: Missing Authorization

Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress = 4.7.9 versions...

CVE-2026-39527: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in WpStream 4.11.2 versions...

CVE-2026-39491: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in JupiterX Core = 4.14.1 versions...

CVE-2026-40795: Missing Authorization

Subscriber Broken Access Control in Amelia = 2.2 versions...

CVE-2026-39450: Authentication Bypass Using an Alternate Path or Channel

Subscriber Broken Authentication in FunnelKit Automations = 3.7.3 versions...

CVE-2026-42651: Missing Authorization

Subscriber Broken Access Control in Classified Listing = 5.3.9 versions...

CVE-2026-48969: Missing Authorization

Subscriber Broken Access Control in Really Simple SSL = 9.5.9 versions...

CVE-2026-39594: Missing Authorization

Subscriber Broken Access Control in Ultra Addons for WPForms = 1.0.11 versions...

CVE-2026-48964: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System = 3.3.6 versions...

CVE-2026-40766: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in MasterStudy LMS = 3.7.25 versions...

CVE-2026-52697: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Taskbuilder = 5.0.7 versions...

CVE-2026-40788: Missing Authorization

Subscriber Broken Access Control in ChatBot = 7.9.7 versions...

CVE-2026-11616

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajaxayiaction handler only applying striptagsescsql — with no allow-list — to the attacker-controlled $POST'type' and $POST'postid' values...

CVE-2026-11616 Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajaxayiaction handler only applying striptagsescsql — with no allow-list — to the attacker-controlled $POST'type' and $POST'postid' values...

CVE-2026-8977

The WP GDPR Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ninjagdprajaxactions' AJAX action in versions up to, and including, 1.0.0. This is due to missing capability and nonce checks on the handleAjaxCalls function, combined with insufficient input...

WordPress plugin WP GDPR Cookie Consent 跨站脚本漏洞

WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed on a WordPress site. The WP GDPR Cookie Consent plugin has a cross-site...