CVE-2026-18109

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

6Storage Rentals < 2.29.0 - Unauthenticated Account Takeover via 'email' Parameter

Description The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.28.0 This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownersh...

CVE-2026-73340

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-66704

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

CVE-2026-66661

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

CVE-2026-66658

Subscriber SQL Injection in Reviewer = 3.14.2 versions...

CVE-2026-66469

Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...

CVE-2026-66478

Unauthenticated SQL Injection in Church Admin = 5.1.1 versions...

CVE-2026-66464

Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...

CVE-2026-66449

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

CVE-2026-66450

Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...

CVE-2026-66456

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-66454

Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...

CVE-2026-66441

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

CVE-2026-66443

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-66444

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-65582

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

CVE-2026-66429

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-66430

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-28189

Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...