CVE-2026-73380

Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...

CVE-2026-73378 WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73378

An unauthenticated Cross-Site Scripting (XSS) vulnerability exists in the WordPress "Contact Form by Supsystic" plugin versions below 1.10.0, allowing remote attackers to inject malicious scripts that execute in users' browsers. CVSS 3.1 scores it HIGH (7.1). Upgrade to version 1.10.0 or later. N...

CVE-2026-73377

The Ultimate Maps by Supsystic WordPress plugin (versions below 1.5.0) has an unauthenticated broken access control flaw allowing remote attackers to perform unauthorized actions with high integrity impact; no exploitation is reported in the provided documents.

CVE-2026-73377 WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73376 WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73376

Ultimate Maps by Supsystic (WordPress plugin, versions

EUVD-2026-60789

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-73367 WordPress Easy Google Maps plugin < 1.14.2 - Remote File Inclusion vulnerability

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

CVE-2026-73367

Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...

EUVD-2026-60788

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73366 WordPress Easy Google Maps plugin <= 1.13.0 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73366

Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...

CVE-2026-73366

The WordPress Easy Google Maps plugin (≤1.13.0) has an unauthenticated PHP Object Injection vulnerability, exploitable remotely without credentials, scoring CVSS 9.8 (Critical). No in-the-wild exploitation or patch details are provided in the documents.

CVE-2026-73365

Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...

CVE-2026-73362

Unauthenticated Cross Site Scripting XSS in URL Shortify = 2.5.0 versions...

CVE-2026-73362

Affected product: WordPress URL Shortify plugin (versions ≤ 2.5.0). Vulnerability: Unauthenticated Cross-Site Scripting (XSS) — no privileges required. CVSS 3.1 base score 7.1 (HIGH), vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Exploitation status: not provided. Remediation: upgrade to a patched ...

CVE-2026-73361

Unauthenticated reflected/stored XSS affects Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18; CVSS 7.1 HIGH (network, no auth, user interaction required). No exploitation details provided; update to a newer plugin version when available.

CVE-2026-73360 WordPress Chaty Pro plugin <= 3.5.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...

CVE-2026-73359

The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (versions ≤4.3.9) has a Subscriber-level stored XSS vulnerability; a low-privilege authenticated user can inject scripts that execute in other users' browsers, rated MEDIUM (CVSS 6.5). No patch version or exploitation evidence is provi...