CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-32444 WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32444 WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32444

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

CVE-2026-32333

Mayosis Core WordPress plugin versions ≤5.4.7 are affected by an unauthenticated reflected Cross Site Scripting (XSS) vulnerability exploitable via network with low attack complexity; CVSS 3.1 score is 7.1 (HIGH), requiring user interaction. No patch version or in-the-wild exploitation details ar...

CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...

CVE-2026-32333 WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...

CVE-2026-28569

CVE-2026-28569 is an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin SSL Zen , affecting versions ≤ 4.7.43 . The vulnerability was discovered by Martino Spagnuolo (r3verii) and carries a CVSS 3.1 base score of 7.1 (HIGH) with a changed scope, indicating ...

CVE-2026-28569

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

EUVD-2026-60894

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

CVE-2026-28569 WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

CVE-2026-28568

Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...

CVE-2026-28567

The WordPress WP Sort Order plugin (versions ≤ 1.3.5) has an unauthenticated broken access control flaw, exploitable over the network with no credentials, exposing sensitive data (CVSS 7.5 HIGH). CISA confirms no active exploitation; upgrade to a patched version. Details at patchstack.com/databas...

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

EUVD-2026-60892

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

CVE-2026-28191

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

EUVD-2026-60890

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Ultimate Dashboard Pro versions = 3.11.2...

WordPress WP Compress plugin <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Compress versions = 7.10.09...

WordPress Slider Hero with Video Background, Animation plugin <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) vulnerability

Authenticated Administrator+ SQL Injection via 'description' Slide Field Second-Order via Duplicate vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Slider Hero versions = 9.1.7...