CVE-2026-78470

WP Project Manager Pro is a WordPress plugin vulnerable to SQL Injection in all versions up to and including 4.0.1 . The root cause is insufficient escaping on a user-supplied parameter combined with a lack of prepared statements in the existing SQL query. An authenticated attacker with Subscribe...

CVE-2026-78467

...

EUVD-2026-65302

The Fluent Support Pro plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized acti...

CVE-2026-78467

...

CVE-2026-78467

CVE-2026-78467 is a reservation duplicate of CVE-2026-78272 and has been rejected by the CNA. The underlying vulnerability affects the Fluent Support Pro plugin for WordPress, specifically a missing capability check on a function in all versions up to and including 2.3.1 . This allows authenticat...

PoC-Pods-Unauthenticated-Privilege-Escalation

PoC-Pods-Unauthenticated-Privilege-Escalation A cr...

CVE-2026-12561 tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render method, which base64-decodes shortcode content...

WordPress tagDiv Composer plugin <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Truoc Phan in WordPress Plugin tagDiv Composer versions = 5.4.5...

CVE-2026-12561 tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vcrawhtml shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vcrawhtml::render method, which base64-decodes shortcode content...

cve-2024-25600

Exploit Repository: CVE-2024-25600 🔥 Unauthenticated RCE Exploit for WordPress Bricks Builder Welcome to the official repository for the CVE-2024-25600 exploit targeting WordPress Bricks Builder version 1.9.6 and below. This exploit allows for the execution of arbitrary code remotely, posing a...

CVE-2026-75930

The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-19943

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-19892

The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to a missing capability check in the ajaxiwarpreviewemail function, which uses isadmin as its only authorization check and allows...

CVE-2026-17089

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'headerformat' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Gutenverse versions = 4.0.2...

CVE-2026-14280

The Events Manager WordPress plugin (≤ 7.3.7.4) is vulnerable to Local File Inclusion via the em_options_save function, specifically through manipulated dbem_data[updates] array keys. An attacker with administrator-level access or above can store a malicious traversal key that is subsequently exe...

EUVD-2026-65278

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

CVE-2026-19943 Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

EUVD-2026-65279

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...