WordPress Betheme plugin <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'iconbox2' Shortcode vulnerability discovered by João Pedro Soares de Alcântara - Kinorth in WordPress Theme Betheme versions = 28.4...

WordPress Gutenverse plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Multiple Blocks vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Gutenverse versions = 4.0.2...

WordPress Mailgun for WordPress plugin <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) vulnerability

Unauthenticated Server-Side Request Forgery SSRF vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os in WordPress Plugin Mailgun for WordPress versions = 2.2.0...

WordPress kk Star Ratings – Rate Post & Collect User Feedbacks plugin <= 5.4.10.3 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Ronnachai Sretawat Na Ayutaya Simonhaskelly in WordPress Plugin kk Star Ratings versions = 5.4.10.3...

WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...

WordPress WS Form LITE – Drag & Drop Contact Form Builder plugin <= 1.10.80 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin WS Form LITE versions = 1.10.80...

WordPress Events Manager – Calendar, Bookings, Tickets, and more! plugin <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion vulnerability

Authenticated Administrator+ Local File Inclusion vulnerability discovered by Wordfence PRISM in WordPress Plugin Events Manager versions = 7.3.7.4...

CVE-2026-78468

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78270. Reason: This candidate is a reservation duplicate of CVE-2026-78270. Notes: All CVE users should reference CVE-2026-78270 instead of this candidate. All references and descriptions in this candidate have been...

WordPress ManageWP Worker plugin < 4.9.37 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Jakub Herman in WordPress Plugin ManageWP Worker versions 4.9.37...

WordPress FiboSearch plugin < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure vulnerability

Unauthenticated Password-Protected Product Information Disclosure vulnerability discovered by Duy Tran in WordPress Plugin FiboSearch versions 1.34.1...

WordPress Limit Login Attempts Security plugin < 3.3.5 - Username Denylist Bypass vulnerability

Username Denylist Bypass vulnerability discovered by Artus KG in WordPress Plugin Limit Login Attempts Reloaded versions 3.3.5...

WordPress All-in-One WP Migration and Backup plugin <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability

Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution vulnerability discovered by Jack Taylor in WordPress Plugin All-in-One WP Migration versions = 7.109...

WordPress ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import 'plugin <wp_option>' Nodes vulnerability

Authenticated Shop Manager+ Privilege Escalation to WXR Import 'plugin ' Nodes vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin ShopEngine versions = 4.9.4...

WordPress MetForm plugin <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'mfformid' Widget Setting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin Metform versions = 4.1.8...

WordPress eCommerce Product Catalog plugin <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'style' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin eCommerce Product Catalog versions = 3.5.10...

WordPress Media Sweep plugin <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'fields' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Media Sweep – WordPress Media Cleaner versions = 1.1.3...

WordPress My Agile Privacy® plugin <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions vulnerability

Missing Authorization to Unauthenticated Plugin Settings Modification via mapmissingcookieshield / mapcheckconsentmodestatus AJAX Actions vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin My Agile Privacy versions = 3.3.6...

CVE-2026-78468

CVE-2026-78468 is a reservation duplicate of CVE-2026-78270 . Per connected documents, the underlying vulnerability affects the FluentCRM Pro WordPress plugin in all versions up to and including 3.1.12 . The root cause is SQL Injection due to insufficient escaping on user-supplied parameters and ...

CVE-2026-78468

...

EUVD-2026-65579

The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...