CVE-2026-57629 WordPress StatCounter plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in StatCounter = 2.1.1 versions...

CVE-2026-57622

CVE-2026-57622 affects the WordPress WPCafe plugin, versions

CVE-2026-57618 WordPress Neve PRO theme <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Neve PRO = 3.1.2 versions...

CVE-2026-57617

SeedProd Pro WordPress plugin versions prior to 6.19.5 are affected by a Cross Site Scripting (XSS) vulnerability. The CVE notes an XSS in SeedProd Pro

EUVD-2026-39738

Contributor Broken Access Control in SEOPress PRO = 9.1.1 versions...

CVE-2026-57430

CVE-2026-57430 : WordPress SEOPress PRO plugin versions ≤ 9.1.1 have a Broken Access Control vulnerability. Context: CVSS v3.1 base score 4.3 (MEDIUM); attack vector Network , complexity Low , privileges required Low , user interaction None ; impact in confidentiality, integrity, availability as ...

CVE-2026-57323 WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Flash & HTML5 Video = 2.11.0 versions...

CVE-2026-57321 WordPress H5P plugin <= 1.17.7 - Arbitrary File Deletion vulnerability

Contributor Arbitrary File Deletion in H5P = 1.17.7 versions...

CVE-2026-57315

CVE-2026-57315 affects the WordPress Blocksy Companion Pro plugin up to version 2.1.45. The connected sources confirm a Remote Code Execution (RCE) vulnerability in this product/version, but do not provide details on root cause, affected files, exploitation steps, or available mitigations. The CV...

CVE-2026-56070 WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability

Unauthenticated SQL Injection in Advance Product Search = 1.4.4 versions...

CVE-2026-56058

CVE-2026-56058 affects the WordPress Quform plugin, specifically versions up to 2.23.0, with a Subscriber Arbitrary File Upload vulnerability. The connected records confirm the affected product and vulnerability class but do not provide root-cause details or a patch/version to remediate within th...

CVE-2026-56038 WordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability

Contributor Privilege Escalation in Frisbii Pay = 1.8.2 versions...

CVE-2026-56026 WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in utm.codes = 1.9.0 versions...

EUVD-2026-39687

Unauthenticated Cross Site Scripting XSS in MapPress Maps for WordPress = 2.97.3 versions...

CVE-2026-54834 WordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone = 2.3.2 versions...

CVE-2026-54833 WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability

Unauthenticated Backdoor in Enable CORS = 2.0.3 versions...

CVE-2026-54831

CVE-2026-54831 affects WordPress GeoDirectory plugin versions 2.8.162 and earlier. It describes an unauthenticated SQL injection vulnerability in GeoDirectory, with CVSS 3.1 indicating network access, no user interaction, high confidentiality impact, and critical overall severity. The provided do...

CVE-2025-63078

The CVE-2025-63078 entry concerns the WordPress plugin “Restaurant Menu by MotoPress” (MotoPress) &lt;= 2.4.11. Affected component is the plugin’s access control mechanism, with root cause described as Broken Access Control. The vulnerability is reported to affect users of the plugin in WordPress...

CVE-2025-63078 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability

Subscriber Broken Access Control in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-4339

Mattermost CPT: CVE-2026-4339 affects Mattermost versions 10.11.x up to 10.11.18, 11.6.x up to 11.6.3, and 11.5.x up to 11.5.6. The vulnerability arises from the Agents plugin MCP server failing to validate attachment URLs against internal/private IP ranges, enabling an attacker with MCP stdio ac...