CVE-2026-81660

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin, in versions prior to 4.5.13 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate or escape values submitted to certain optional web form fields (specifically dropdown or radio f...

CVE-2026-78364 MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-78364

The MW WP Form WordPress plugin, in versions prior to 5.1.6 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape certain form settings before they are rendered on an admin dashboard page. This flaw allows users with permissions as low ...

CVE-2026-76585 Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

CVE-2026-76585

The Customer Reviews for WooCommerce WordPress plugin (versions before 5.118.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape the content of customer reviews received via one of the plugin's endpoints, specifically involving th...

CVE-2026-81766

The Really Simple Security WordPress plugin (versions before 9.8.0 ) is vulnerable to an arbitrary plugin installation flaw. Due to insufficient authorization checks during the plugin installation process, a subsite administrator on a multisite network can install and execute arbitrary code withi...

CVE-2026-14307

The geotargetingwp WordPress plugin, in versions prior to 3.5.6.2 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw occurs because the plugin fails to sanitize or escape several parameters before reflecting them in AJAX responses served with an HTML content type . This allows una...

CVE-2026-14307 Geotargeting WP < 3.5.6.2 - Reflected XSS

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into...

EUVD-2026-68155

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into...

CVE-2026-14307 Geotargeting WP < 3.5.6.2 - Reflected XSS

The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into...

CVE-2026-19722

The WPvivid — Backup, Migration & Staging WordPress plugin (versions before 0.9.133 ) is vulnerable to a Zip Slip path-traversal condition during the backup restoration process. The application fails to validate the destination paths of files extracted from a backup package, allowing high-privile...

EUVD-2026-68156

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

CVE-2026-19722 WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

CVE-2026-76585 Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

EUVD-2026-68158

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-78364 MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-81766 Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin

The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.8.0 before installing one from a user-supplied URL, allowing an administrator of a subsite on a multisite network to install and execute...

CVE-2026-14835 SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

WordPress SOGO Add Script to Individual Pages Header Footer plugin <= 3.9 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Chamseddine Bouzaiene in WordPress Plugin SOGO Add Script to Individual Pages Header Footer versions = 3.9...

EUVD-2026-68154

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...