CVE-2026-61959 WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-61961

CVE-2026-61961 concerns the WordPress plugin EmbedPress (versions

EUVD-2026-53952

Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...

EUVD-2026-53941

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

CVE-2026-28111

CVE-2026-28111 affects the WordPress Forminator plugin up to version 1.56.0. The vulnerability is a contributor privilege escalation, with CVSSv3.1 metrics indicating high impact (C/H, I/H, A/H) and network attack vector with low complexity and low privileges required. Connected sources confirm t...

CVE-2026-28111 WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Forminator = 1.56.0 versions...

EUVD-2026-53942

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

EUVD-2026-53940

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

EUVD-2026-53939

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer = 1.5.19 versions...

EUVD-2026-53938

Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons = 3.0.5 versions...

EUVD-2026-53937

Unauthenticated Broken Access Control in Simple Membership = 4.7.8 versions...

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin GeekyBot versions = 1.2.6...

EUVD-2026-53927

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...

EUVD-2026-53924

A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to...

CVE-2025-15028

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This...

CVE-2025-9266

CVE-2025-9266 affects the WordPress Accelerate theme up to version 1.5.3. The root cause is a missing capability check in enqueue_scripts(), enabling authenticated users with Subscriber-level access and above to install and activate the ThemeGrill Demo Importer plugin. The impact is unauthorized ...

Important: Red Hat Security Advisory: OpenShift Source To Image 1.6.3

OpenShift Source To Image 1.6.3 Release Release of OpenShift Source To Image 1.6.3...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...

CVE-2026-18998

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegatetask Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The...