CVE-2026-66667

The WordPress Templately plugin (versions ≤ 3.7.1) contains an unauthenticated reflected/stored XSS vulnerability discovered by researcher daroo, rated CVSS 7.1 (HIGH). Attackers can inject malicious scripts via network requests requiring no authentication, potentially compromising user sessions ...

CVE-2026-66651

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-66646

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66645

The WordPress Table Of Contents Block plugin (≤1.5.0) allows authenticated contributors to inject cross-site scripting payloads. CVSS 3.1 scores 6.5 (Medium) with network attack vector and low privileges required. No exploit code or in-the-wild exploitation is documented in the provided materials.

EUVD-2026-60928

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66644

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66643 WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

EUVD-2026-60927

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

CVE-2026-66643

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

CVE-2026-66641

Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...

CVE-2026-66641

The WordPress Video Conferencing with Zoom plugin (versions

CVE-2026-66638

The Frontend Admin by DynamiApps WordPress plugin (versions ≤ 3.29.10) contains a contributor-level reflected/stored Cross-Site Scripting (XSS) flaw. A user with contributor privileges can inject malicious scripts that execute in other users' browsers. CVSS 3.1 scores this MEDIUM (6.5) with netwo...

EUVD-2026-60923

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-66636 WordPress Wise Chat plugin <= 3.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Wise Chat = 3.4 versions...

CVE-2026-66636

Contributor Cross Site Scripting XSS in Wise Chat = 3.4 versions...

EUVD-2026-60920

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-66633 WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-66634

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...

CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...