CVE-2026-84752

CVE-2026-84752 affects the WordPress RTMKit plugin (Rometheme for Elementor) in versions 2.1.5 and earlier . The vulnerability is a PHP Object Injection that can be exploited by a user with Contributor privileges, resulting in high impact on confidentiality, integrity, and availability (CVSS 8.8 ...

CVE-2026-84215 WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-81776

CVE-2026-81776 affects the WordPress WP QuickLaTeX plugin in versions

EUVD-2026-70592

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

CVE-2026-81773

CVE-2026-81773 affects the WordPress Ninja Forms File Uploads Extension plugin in versions 3.3.26 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning no prior authentication is required to exploit it. The CVSS 3.1 base score is 7.1 (HIGH) with a vector of ...

CVE-2026-81776 WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

CVE-2026-81773 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...

CVE-2026-81776 WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

CVE-2026-81300 WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

CVE-2026-81300 WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...

CVE-2026-81295 WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Under Construction = 5.82 versions...

CVE-2026-81295 WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Under Construction = 5.82 versions...

CVE-2026-81295

CVE-2026-81295 affects the WordPress Under Construction plugin (versions ≤ 5.82 ) with an unauthenticated Cross-Site Scripting (XSS) flaw, as identified by Patchstack. The CVSS 3.1 score is 7.1 (HIGH) with the vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-based attack with low ...

CVE-2026-81292 WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Simple Payment = 2.5.1 versions...

CVE-2026-81292

WordPress Simple Payment plugin versions ≤ 2.5.1 are affected by an unauthenticated Cross Site Scripting (XSS) vulnerability, as reported by Patchstack. The flaw requires user interaction but no prior authentication, and operates over the network with low complexity. The CVSS 3.1 base score is 7....

CVE-2026-84849 WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...

CVE-2026-84849 WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce = 2.3 versions...

CVE-2026-84849

CVE-2026-84849 affects the Pre-Orders for WooCommerce WordPress plugin in versions 2.3 and earlier . The vulnerability is an unauthenticated bypass , meaning no prior login is required to exploit it. The CVSS 3.1 score is 6.5 (MEDIUM) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicati...

Exploit for CVE-2026-8181

CVE-2026-8181 — Burst Statistics Authentication Bypass to Admin...

CVE-2026-2573

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This mak...