WordPress Smart Post plugin 4.0.0-4.0.7 - Contributor+ Private and Protected Post Content Disclosure vulnerability

Contributor+ Private and Protected Post Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Post Grid, Post Carousel, & List Category Posts – by Smart Post Show versions 4.0.0-4.0.7...

CVE-2026-78149

The Smart Post WordPress plugin (versions 4.0.0-4.0.7 ) contains a vulnerability where it fails to verify if a post is password protected before returning its content and stored password via an unauthenticated AJAX action (specifically via sp_handle_post_id). This allows unauthenticated users to ...

EUVD-2026-71851

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPress plugin before 3.0.3 and take over the site...

CVE-2026-78362

The SEO Flow by LupsOnline WordPress plugin versions 3.0.0 through 3.0.2 is vulnerable to an unauthenticated privilege escalation vulnerability. The root cause is the plugin's failure to correctly validate credentials provided with its API requests . This flaw allows an unauthenticated attacker t...

CVE-2026-15247 Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

CVE-2026-19861 JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrato...

CVE-2026-19858 JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...

EUVD-2026-71846

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...

EUVD-2026-71845

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

CVE-2026-19858

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin, in versions prior to 3.6.5.2 , is vulnerable to an information disclosure flaw. The root cause is a failure to perform authorisation checks when resolving request-derived data during page rendering. This allows unauthenticated use...

CVE-2026-15247 Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

CVE-2026-19858 JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...

WordPress Search Atlas SEO plugin < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion vulnerability

Subscriber+ Google Service Account Credential Overwrite/Deletion vulnerability discovered by Shivamani Vastrala in WordPress Plugin Search Atlas SEO versions 2.6.24...

CVE-2026-15247

The Search Atlas SEO WordPress plugin (versions before 2.6.24 ) contains a vulnerability due to a missing nonce or capability check when processing settings updates in an early-priority handler. This flaw allows any authenticated user , such as one with Subscriber privileges, to overwrite or dele...

CVE-2026-19861

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin (versions before 3.6.5.2 ) is vulnerable to unauthenticated stored XSS and HTML injection. The root cause is the failure to properly sanitise and escape a form field's value before including it in HTML notification emails. This all...

EUVD-2026-71847

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrato...

EUVD-2025-210850

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...

CVE-2025-15693

The JCH Optimize WordPress plugin (versions 4.2.1-5.0.0 ) contains a path traversal vulnerability. The flaw exists because the plugin fails to properly restrict directory paths provided to one of its administrative image-browsing features to the site directory. This allows high-privilege users, s...

CVE-2025-15694

The Joli Table Of Contents WordPress plugin, in versions 2.0.0 through 2.8.0 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape specific plugin settings before displaying them on an admin page. This allows high-privilege users, such as admi...

WordPress Joli Table Of Contents plugin 2.0.0-2.8.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Joli Table Of Contents versions 2.0.0-2.8.0...