CVE-2026-84021

The Bold Page Builder WordPress plugin, in versions prior to 5.9.8 , is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the improper validation of link URLs before they are output as HTML attributes, as the existing filter can be evaded. This allows users with ...

CVE-2026-84022

The Bold Page Builder WordPress plugin, in versions before 5.9.8 , is vulnerable to a Stored XSS flaw because it fails to sanitize and escape several shortcode attributes before outputting them into HTML attributes. This oversight allows users with Contributor roles or higher to inject arbitrary ...

CVE-2026-83544 Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute

The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-81423 Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler

The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing...

CVE-2026-82846 Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the cours...

CVE-2026-81348 My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login...

CVE-2026-81348

The My Private Site WordPress plugin, specifically versions before 4.2.3 , contains a vulnerability where site-privacy access controls are not correctly applied to certain unauthenticated front-end read surfaces. This oversight allows unauthenticated users to view post content , comments , and po...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82846

The Masteriyo LMS WordPress plugin (versions 1.18.0-2.3.3 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw because it fails to properly sanitize and escape certain course settings. An attacker with a course-author role can inject malicious scripts into these settings, which then execut...

EUVD-2026-71855

The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing...

CVE-2026-81424 Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR

The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing...

CVE-2026-81424 Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR

The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the authoritative payment was actually made for, checking only that the amount paid is at least the referenced product's price, allowing...

CVE-2026-82304 Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-82846 Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the cours...

WordPress Accept Stripe Payments plugin < 2.1.4 - Open Redirect vulnerability

Open Redirect vulnerability discovered by Usama Arshad in WordPress Plugin Stripe Payments versions 2.1.4...

EUVD-2026-71857

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the cours...

CVE-2026-81404 IPGP Visitors Origin < 1.6 - Reflected XSS

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

EUVD-2026-71854

The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing...

CVE-2026-81404 IPGP Visitors Origin < 1.6 - Reflected XSS

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

CVE-2026-82304

The Music Store WordPress plugin (versions before 1.4.5 ) is vulnerable to an unauthenticated SQL injection (SQLi). The root cause is the failure to sanitise and escape user input before its inclusion in a SQL statement. Specifically, the vulnerability exists within the paypal-data handler. An un...