WordPress GamiPress plugin < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award vulnerability

Subscriber+ Arbitrary User Points and Achievement Award vulnerability discovered by Shivamani Vastrala in WordPress Plugin GamiPress versions 7.9.9.6...

WordPress Social Media Share Buttons & Social Sharing Icons plugin < 3.0.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Social Media & Share Icons versions 3.0.1...

WordPress Photo Gallery by 10Web plugin < 1.8.44 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Photo Gallery by 10Web versions 1.8.44...

WordPress JetBackup plugin 3.1.7.9-3.1.23.3 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Backup Guard versions 3.1.7.9-3.1.23.3...

WordPress Advanced Custom Fields: Extended plugin < 0.9.2.7 - Unauthenticated Administrator Account Takeover vulnerability

Unauthenticated Administrator Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin ACF Extended versions 0.9.2.7...

WordPress Advanced Custom Fields: Extended plugin 0.9.2.2-0.9.2.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin ACF Extended versions 0.9.2.2-0.9.2.6...

CVE-2026-2573 GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-2573 GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This mak...

PT-2026-85106

Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...

PT-2026-85097

Unauthenticated Broken Access Control in WPFunnels = 3.12.13 versions...

PT-2026-85124

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

PT-2026-85140

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5...

CVE-2026-82023: Incorrect Authorization

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

PT-2026-85111

Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.11 versions...

PT-2026-85092

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

PT-2026-85105

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

PT-2026-85100

Unauthenticated Settings Change in WP Compress = 7.21.28 versions...

CVE-2026-75134

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attacker...

CVE-2026-75134 SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attacker...

EUVD-2026-70263

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attacker...