CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

CVE-2026-66711

Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...

CVE-2026-66708

Unauthenticated Broken Access Control in Total Upkeep = 1.17.2 versions...

CVE-2026-66439

Unauthenticated Cross Site Scripting XSS in Advanced AJAX Product Filters = 3.2.0.3 versions...

CVE-2026-61959

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-66709

The CVE-2026-66709 entry describes a Remote Code Execution (RCE) vulnerability in the WordPress CTX Feed plugin (CTX Feed)

CVE-2026-66703 WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in MailOptin = 1.2.78.0 versions...

EUVD-2026-53898

Contributor Cross Site Scripting XSS in Ultimate Addons for Elementor = 1.45.2 versions...

CVE-2026-66665 WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Type Hub = 2.0.6 versions...

CVE-2026-66457 WordPress Events Manager plugin <= 7.4.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Events Manager = 7.4.1 versions...

CVE-2026-66451

CVE-2026-66451 affects the WordPress plugin WP Event Solution (

CVE-2026-66425 WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

CVE-2026-66425 WordPress Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin <= 1.9.0 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder = 1.9.0 versions...

EUVD-2026-53989

Unauthenticated PHP Object Injection in 69 Clothing = 1.2.11.1 versions...

CVE-2026-65552

CVE-2026-65552 concerns the WordPress Export User Data plugin (versions

EUVD-2026-53951

Shop manager Cross Site Scripting XSS in FiboSearch = 1.33.0 versions...

EUVD-2026-53944

Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...

CVE-2026-28005

CVE-2026-28005 is an unauthenticated privilege-escalation vulnerability affecting the WordPress plugin Kadence WooCommerce Email Designer (

CVE-2026-11527

A flaw was found in Config::IniFiles. This vulnerability allows an attacker to achieve OS command injection or overwrite files. By supplying untrusted input to the -file argument, an attacker can execute arbitrary commands or truncate files under the privileges of the application. This occurs...

CVE-2025-9266

CVE-2025-9266 affects the WordPress Accelerate theme up to version 1.5.3. The root cause is a missing capability check in enqueue_scripts(), enabling authenticated users with Subscriber-level access and above to install and activate the ThemeGrill Demo Importer plugin. The impact is unauthorized ...