EUVD-2026-76039

The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin from 1.2.2 before 1.42.3 runs the shortcode parser over the whole rendered Contact Form 7 form, including the values a visitor submitted, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

EUVD-2026-76038

The Payment Gateway PayPay for WooCommerce WordPress plugin from 0.5 to 0.9.3 does not verify the authenticity of the payment notifications it receives before acting on them, allowing unauthenticated attackers who know the store's merchant identifier to mark arbitrary orders as paid, or to cancel...

CVE-2026-82215

The Payment Gateway PayPay for WooCommerce WordPress plugin (versions 0.5 through 0.9.3) fails to verify the authenticity of incoming payment notification webhooks before acting on them. An unauthenticated attacker who knows a store's merchant identifier can mark arbitrary orders as paid , or can...

EUVD-2026-76037

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...

CVE-2026-82213

CVE-2026-82213 affects the Nexi XPay Build WordPress plugin, versions 7.6.1 through 7.6.2 . The root cause is an Insecure Direct Object Reference (IDOR) flaw: the plugin does not verify that a requested saved payment token belongs to the current user. As a result, unauthenticated attackers can re...

CVE-2026-82213 Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...

WordPress Nexi XPay Build plugin 7.6.1-7.6.2 - Unauthenticated Saved Payment Token Disclosure vulnerability

Unauthenticated Saved Payment Token Disclosure vulnerability discovered by ryan fabella in WordPress Plugin Nexi XPay Build versions 7.6.1-7.6.2...

CVE-2026-82213 Nexi XPay Build 7.6.1 - 7.6.2 - Unauthenticated Saved Payment Token Disclosure via IDOR

The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing unauthenticated attackers to retrieve other customers' stored card token references together with a valid authorisation signature...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin Kirki versions = 6.2.0...

WordPress Unlimited Elements For Elementor plugin <= 2.0.16 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.16...

CVE-2026-17037

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress HUSKY plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Kuba in WordPress Plugin HUSKY versions = 1.4.3...

WordPress Gato GraphQL plugin <= 19.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by benzdeus in WordPress Plugin Gato GraphQL versions = 19.2.3...

CVE-2026-17037 Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

WordPress Masteriyo - LMS plugin = 3.4.0 - PHP Object Injection vulnerability discovered by 20kilograma in WordPress Plugin Masteriyo - LMS versions = 3.4.0...

WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by nh4tvd in WordPress Plugin ThemeREX Addons versions 2.45.0...

CVE-2026-6641

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

CVE-2026-6640

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress CM HIPAA Forms plugin < 3.2.0 - Unauthenticated Authorization Bypass vulnerability

Unauthenticated Authorization Bypass vulnerability discovered by David Ballard in WordPress Plugin HIPAA FORMS versions 3.2.0...

WordPress SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin < 4.7.40 - Subscriber+ TLS Private Key Disclosure vulnerability

Subscriber+ TLS Private Key Disclosure vulnerability discovered by Suhayb Ahmed cyboltx in WordPress Plugin SSL Zen versions 4.7.40...