CVE-2026-73354 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SimplyRETS Real Estate IDX = 3.2.8 versions...

CVE-2026-73347

The WordPress TrueBooker appointment booking plugin (versions ≤ 1.2.6) allows unauthenticated remote attackers to escalate privileges, scoring CVSS 9.8 (CRITICAL). No patch version or exploit details are provided in the documents; users should upgrade once a patched release is available.

EUVD-2026-62381

Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...

EUVD-2026-62379

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

EUVD-2026-62380

Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...

EUVD-2026-62373

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin SmartSMTP versions = 1.2.0...

WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...

WordPress WordPress Persistent Login plugin <= 3.1.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WordPress Persistent Login versions = 3.1.0...

WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Advance Product Search versions = 1.4.8...

WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Elijah Chia in WordPress Plugin Form Maker by 10Web versions = 1.15.46...

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...

exploit-CVE-2015-8351

Gwolle Guestbook WordPress Plugin RFI Exploit Dieses Python-Skript nutzt eine kritische Remote File Inclusion RFI-Schwachstelle im Gwolle Guestbook WordPress Plugin aus, die von einem nicht authentifizierten Angreifer ausgenutzt werden kann, um eine entfernte PHP-Datei einzubinden und beliebigen...

WordPress TaxoPress plugin <= 3.51.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin TaxoPress versions = 3.51.0...

WordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

WordPress Total Donations plugin <= 2.0.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Total Donations versions = 2.0.5...

CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress SAML Single Sign On plugin 4.8.85-5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite vulnerability

Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite vulnerability discovered by Suhayb Ahmed in WordPress Plugin SAML Single Sign On – SSO Login versions 4.8.85-5.4.6...

WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Thaer Assfour in WordPress Plugin Contest Gallery versions = 30.0.5...

CVE-2026-15446

The EWWW Image Optimizer WordPress plugin (all versions up to and including 8.7.3 ) is vulnerable to Stored Cross-Site Scripting via the data-script Lazy Load attribute in post content. The root cause is insufficient input sanitization and output escaping: an attacker with contributor-level acces...