CVE-2026-32333

Mayosis Core WordPress plugin versions ≤5.4.7 are affected by an unauthenticated reflected Cross Site Scripting (XSS) vulnerability exploitable via network with low attack complexity; CVSS 3.1 score is 7.1 (HIGH), requiring user interaction. No patch version or in-the-wild exploitation details ar...

CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...

CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...

CVE-2026-28571 WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

CVE-2026-28569

CVE-2026-28569 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin SSL Zen , affecting versions ≤ 4.7.43 . The vulnerability was discovered by Martino Spagnuolo (r3verii) and carries a CVSS 3.1 base score of 7.1 (HIGH) with a changed scope, indicating ...

CVE-2026-28569

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

CVE-2026-28569 WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

EUVD-2026-60894

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

CVE-2026-28568

Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

EUVD-2026-60892

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28567

The WordPress WP Sort Order plugin (versions ≤ 1.3.5) has an unauthenticated broken access control flaw, exploitable over the network with no credentials, exposing sensitive data (CVSS 7.5 HIGH). CISA confirms no active exploitation; upgrade to a patched version. Details at patchstack.com/databas...

CVE-2026-28567 WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28191

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

EUVD-2026-60890

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

WordPress Eventin plugin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting vulnerability

Editor+ Local File Inclusion via speakertemplate Setting vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WP Event SOlution versions 4.1.20...

WordPress Nexter Blocks plugin < 5.0.2 - Author+ Stored XSS via SVG Upload vulnerability

Author+ Stored XSS via SVG Upload vulnerability discovered by Bob Matyas in WordPress Plugin Nexter Blocks versions 5.0.2...

WordPress GeoDirectory plugin < 2.8.110 - Editor+ Stored XSS via Place Categories vulnerability

Editor+ Stored XSS via Place Categories vulnerability discovered by Krugov Artyom in WordPress Plugin GeoDirectory versions 2.8.110...

WordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin YITH WooCommerce Membership Premium versions = 2.33.0...

WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin PDF Smart Viewer for Elementor versions = 1.0.4...